Claude Code CVE-2026-88968: Edit Tool TOCTOU Can Write Outside the Workspace on macOS

GitHub reviewed GHSA-5xjx-9qx6-jcrv (CVE-2026-88968) on November 9, 2026: Claude Code before 2.1.251 could use the Edit tool to overwrite user-writable files outside the project workspace on macOS when malicious code won a symlink race inside the Bash sandbox. If you run Claude Code on a Mac against untrusted repositories, run claude --version, upgrade to 2.1.251 or later if you are below that build, and keep treating cloned dependencies like supply-chain input.

The flaw is not another plugin marketplace bug. It sits in the Edit tool boundary between sandboxed Bash (where repo scripts run) and the unsandboxed editor that actually applies file changes. Anthropic credits reporter Sunder Singh (hackerone.com/mahoraga007) and documents fix release v2.1.251. NVD published CVE-2026-88968 on November 3, 2026.

For tooling context, Claude Code is Anthropic's terminal coding agent (/cve/tool/claude-code). Our earlier write-up of CVE-2026-86063 plugin hash pinning covered install-time trust; this issue is about workspace containment at edit time.

TL;DR

What the advisory says

Anthropic's description, quoted in substance from GHSA-5xjx-9qx6-jcrv:

• Claude Code validated Edit targets using point-in-time pathname and symlink resolution that was not bound to underlying directory inodes or file descriptors.
• On macOS, a process in the Bash sandbox could exploit the resulting time-of-check to time-of-use (TOCTOU) window by atomically swapping an in-workspace parent directory with a symlink after validation completed.
• The unsandboxed Edit implementation could then overwrite an attacker-selected user-writable file outside the workspace.
• Exploitation required attacker-controlled code inside the sandbox, such as a malicious repository or dependency script.

Weaknesses listed are CWE-367 (TOCTOU) and CWE-59 (improper link resolution before file access). EPSS was about 0.317% when GitHub reviewed the entry on November 9, 2026.

CVSS v4 base metrics in the advisory include Attack Vector: Network, Attack Complexity: Low, Attack Requirements: Present, Privileges Required: None, User Interaction: Passive, and high integrity impact on the vulnerable system — consistent with an agent session where the user opened a project and the model later edits files on their behalf.

Attack chain, step by step

This is the logical chain implied by the advisory, not a reproduced exploit:

1. Victim opens a repository in Claude Code that contains attacker-controlled executable content (malicious postinstall, Makefile target, test harness, or similar) able to run inside the Bash sandbox.
2. Agent or user workflow triggers Edit on a path that appears inside the workspace at validation time. Claude Code records the intended target using pathname and symlink checks at one instant.
3. Sandboxed attacker code races the check. Between validation and the actual write, attacker code replaces an in-workspace parent directory with a symlink pointing at a sensitive location outside the tree (for example a dotfile in $HOME or another user-writable config).
4. Unsandboxed Edit follows the swapped link. Because resolution was not bound to inodes or open file descriptors, the editor writes outside the workspace to whatever path the symlink now references.
5. Outcome is integrity compromise on user-writable files — not necessarily immediate exfiltration, but enough to plant persistence, hijack shell profiles, or poison the next tool invocation.

The split between sandboxed Bash and unsandboxed Edit matters for defenders. Many teams assume "the agent only touches the repo folder." This bug shows that assumption can fail on macOS when validation and write use different trust anchors.

Timeline

Who is affected

In scope:

• Developers running @anthropic-ai/claude-code before 2.1.251 on macOS
• Workflows that let Claude Code Edit files automatically in repositories whose build or install scripts are not fully trusted
• Security researchers and red teams testing agent sandbox boundaries — this is a concrete bypass class (TOCTOU on symlinks)

Lower immediate risk:

• Installs already on 2.1.251+ via Anthropic auto-update
• Environments where Claude Code is not used on macOS (advisory does not claim parity on other OSes)
• Sessions limited to read-only review with edits disabled — still keep the package updated because the vulnerable code ships in the binary

Check versions:

claude --version
npm ls @anthropic-ai/claude-code

Upgrade manual npm installs:

npm install -g @anthropic-ai/claude-code@latest

Confirm claude --version reports 2.1.251 or newer after install.

What this means if you run AI coding agents

Claude Code's value proposition is fast, autonomous edits across a tree. That automation is exactly what makes boundary failures costly: the user may not watch every path the Edit tool resolves.

Concrete habits after this disclosure:

• Patch first. This is not mitigated by prompt instructions alone.
• Treat cloned repos like CI runners treat PRs from forks. Do not run unattended claude sessions on unknown trees; prefer disposable working copies and separate accounts for untrusted OSS, as we noted in when Claude deleted a professor's syllabus.
• Watch dependency install hooks. The advisory explicitly names dependency scripts as a sandbox entry point. Combine version pinning with MCP server security review before agents execute install commands.
• Log and deny destructive patterns elsewhere. Even after patch, symlink races are a class that appears in other tools. Use workspace enforce policy for recursive delete and credential-heavy commands where hooks apply — see stopping dangerous Claude Code commands.

If your organization documents "agents may only modify files under ./src," this CVE is a reminder that enforcement must live in the harness, not in policy PDFs.

How symlink TOCTOU bugs show up in other agent sandboxes

This disclosure is specific to Claude Code's Edit path, but the pattern is familiar across agent products: one component checks a path under a sandbox policy, while another component uses the path later without holding a stable reference to the underlying object.

Security teams routinely see variants of CWE-59 and CWE-367 in:

• Archive extraction where a tarball passes a scanner but swaps symlinks before unpack
• CI workspaces where a job validates ./build but a concurrent step retargets a parent directory
• Container bind mounts where the host path changes between policy evaluation and write

Agent harnesses add a twist because the model may issue dozens of edits in quick succession while repository code still runs in parallel. That concurrency widens the race window compared with a single human saving a file in an IDE.

Beam covered a different boundary failure in Google's microVM agent sandbox design — credentials kept out of the guest — and Capsem's VM-isolated coding agent — full machine separation. CVE-2026-88968 is narrower: a logical boundary bug on macOS without leaving the host. Patching remains mandatory even if you experiment with heavier isolation for untrusted tasks.

How to tell if you may have been affected

The advisory does not ship indicators of compromise. Reasonable post-incident checks after working in a suspicious repo on a vulnerable build:

• Compare modification times on sensitive dotfiles (~/.zshrc, ~/.bashrc, ~/.gitconfig, SSH config, cloud CLI credentials) against your last known intentional edit.
• Look for new launch agents or cron entries you did not author, especially if edits correlated with a Claude session on that tree.
• Re-open the git history of the suspicious repo for install scripts that ran during the session window.
• If your team stores Claude transcripts, search for Edit tool calls on paths that later show up as modified outside the repo.

None of these prove exploitation; they prioritize review after unpatched macOS sessions on untrusted code. If anything looks wrong, rotate cloud and SCM tokens that lived on the same user account and rebuild the working copy from a known-good commit.

Auto-update channels vs manual npm installs

Anthropic states that standard Claude Code auto-update users already received 2.1.251. Manual paths need an explicit check:

Pin the version in CI if your security team requires proof of patch level before agents touch production branches — the same discipline we recommend for fastapi-code-generator after November's RCE advisories.

What Beam can and cannot do here

Beam does not close this TOCTOU gap. The race happens between Anthropic's Edit validation and write inside Claude Code; Beam's Claude Code integration observes proposed tool calls through PreToolUse hooks and can deny matched patterns when workspace policy is in enforce mode, but it does not re-validate every filesystem resolution the editor performs afterward.

What Beam still helps with on the same machine:

• Record Edit and Bash proposals so an incident review can show whether the agent attempted changes around the time a repo script ran.
• Deny separate high-risk commands (credential exfiltration curls, recursive deletes) that often follow a successful local persistence write — hook coverage is documented under agent hooks.
• Scan skills and MCP configs for risky install patterns before sessions start, per the 11 heuristic patterns — complementary to, not a substitute for, patching Claude Code.

Missing or expired cached policy is fail-open on hooks. Beam is not a kernel sandbox.

Related reading

• Claude Code plugin hash pin bypass (CVE-2026-86063)
• Stop Claude Code dangerous commands with workspace policy
• Unauthorized relays when sandbox settings are wrong
• November 2026 attacks timeline
• Beam landing: what gets watched

Frequently asked questions

What is CVE-2026-88968?

It is a high-severity TOCTOU flaw in Claude Code before 2.1.251. The Edit tool validated targets using point-in-time pathname and symlink resolution not bound to directory inodes or file descriptors, so attacker code in the Bash sandbox could swap a parent directory for a symlink after validation and make the unsandboxed Edit implementation overwrite a user-writable file outside the workspace.

Which Claude Code versions are patched?

Versions below 2.1.251 are affected per GHSA-5xjx-9qx6-jcrv. Patched release is 2.1.251. Anthropic says standard auto-update users already received the fix; manual installers should update to the latest release.

Does this require opening a malicious project?

Yes. The advisory states exploitation requires attacker-controlled code running inside the Bash sandbox, such as from a malicious repository or a dependency install script. It is not a remote unauthenticated network attack by itself.

Which operating systems are affected?

The published advisory describes reproduction on macOS. It does not claim identical behavior on Linux or Windows. Treat macOS Claude Code installs below 2.1.251 as in scope until Anthropic documents otherwise.

How do I check my Claude Code version?

Run claude --version and confirm 2.1.251 or newer. For npm installs, run npm ls @anthropic-ai/claude-code and compare to 2.1.251.

Can Beam block this TOCTOU race?

No. The flaw is inside Anthropic Edit path validation, not a tool call Beam hooks see before the write completes. Beam can still observe and deny other risky Claude Code tool calls through PreToolUse hooks when workspace policy is in enforce mode, but that does not substitute for patching.

Version numbers, CVSS fields, and advisory text reflect GitHub and NVD as of 2026-11-09. Re-check Anthropic releases before relying on them in production.