{"data":{"id":"e2dbdd18-23d6-44b0-bbe3-e5d156ab7a22","title":"CVE-2026-39861: Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed…","summary":"Claude Code versions before 2.1.64 let sandboxed processes create symlinks pointing outside the workspace. When Claude Code later wrote through such a symlink, its unsandboxed process followed it and wrote to the external target without asking the user for confirmation, enabling a sandbox escape that could potentially lead to code execution outside the sandbox. Exploitation required injecting untrusted content into the Claude Code context window to trigger sandboxed code execution.","solution":"Fixed in version 2.1.64. Users on standard auto-update received the fix automatically; users performing manual updates are advised to update to version 2.1.64 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39861","publishedAt":"2026-04-21T01:16:06.647Z","cveId":"CVE-2026-39861","cweIds":["CWE-22","CWE-61"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 2.1.64 (fixed: 2.1.64)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code sandbox escape through symlinks outside the workspace","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00804,"epssCheckedAt":"2026-10-14T18:05:58.877Z","kevDateAdded":null,"advisoryAliases":["GHSA-vp62-r36r-9xqp"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:22.575Z","patchAvailable":true,"disclosureDate":"2026-04-21T01:16:06.647Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0051"]}}