HighVulnerabilityLLM-specific
CVE-2026-39861: Claude Code sandbox escape through symlinks outside the workspace
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-39861
- Published
- Record updated
- Affected
- @anthropic-ai/claude-code < 2.1.64
- Fixed in
- 2.1.64
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.8%
Summary
Claude Code versions before 2.1.64 let sandboxed processes create symlinks pointing outside the workspace. When Claude Code later wrote through such a symlink, its unsandboxed process followed it and wrote to the external target without asking the user for confirmation, enabling a sandbox escape that could potentially lead to code execution outside the sandbox. Exploitation required injecting untrusted content into the Claude Code context window to trigger sandboxed code execution.
Mitigation
Fixed in version 2.1.64. Users on standard auto-update received the fix automatically; users performing manual updates are advised to update to version 2.1.64 or later.
Topics
Related items
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
- HighCVE-2026-101998: Docker Sandboxes fail open when masking credentials in proxy responsesSame vendor · NVD/CVE Database
- HighCVE-2026-103435: Claude Code symlink race condition allows writes outside project directorySame vendor · NVD/CVE Database
- HighGHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverSame vendor · GitHub Advisory Database
- HighCVE-2026-103012: Claude Code stored API key overrides organization policy sign-inSame vendor · NVD/CVE Database