Advisories

Claude Code versions before 2.1.251 have a flaw in the Edit tool, which validates target paths by pathname and symlink resolution without binding them to the directory inode or file descriptor. On macOS, code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, so the unsandboxed Edit implementation overwrites a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script.

Claude Desktop on Windows, prior to 1.8089.0, calls git.exe through uv_spawn without an absolute path. Windows search-path resolution can therefore pick a malicious git.exe placed in the opened project's current working directory, so opening an attacker-controlled or shared repository executes the substituted program with the user's privileges.

praktor, a multi-agent Claude Code orchestrator with Telegram input, has a path traversal flaw in both Telegram upload sites in `internal/telegram/bot.go` before 0.9.1. The attacker-controlled document filename is concatenated into the destination path without sanitization, and `path.Join` collapses parent-directory traversal, so a remote Telegram user can write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. With `allow_from: []`, which permits all senders by default, no authentication is needed, and the attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook or configuration files that the agent reads on later runs. The demonstrated write scope is the workspace volume, not the unrestricted host filesystem.

Affected versions of the MCP TypeScript SDK put no limit on the size of HTTP POST bodies or on the number of messages in a JSON-RPC batch, so large requests can exhaust server memory and a long batch can block other clients. Exploitation needs no credentials unless the application authenticates requests before they reach the SDK, and stdio-only servers are not affected.

The MCP TypeScript SDK (`@modelcontextprotocol/sdk` 1.3.0 through 1.31.0, and `@modelcontextprotocol/server` 2.0.0 through 2.2.0) placed no limit on the number of array elements and object keys it validated per request. A single HTTP request within the default 4 MiB size limit can exhaust server memory and abort the process with `JavaScript heap out of memory`. No credentials are needed unless requests are authenticated before reaching the SDK, and stdio-only servers are not affected.

Affected versions of the MCP TypeScript SDK (@modelcontextprotocol/sdk 1.24.0 through 1.31.0) did not check which session created an experimental task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Only servers that pass taskStore to McpServer or Server are affected.

Claude Agent SDK for Python, prior to 0.2.121, passes the resume option to the Claude CLI as a separate token without validation. A dash-leading value is parsed as an independent CLI flag, so an attacker can inject --mcp-config to define a stdio MCP server and execute arbitrary commands at CLI startup, outside SDK permission controls. Exploitation requires an application that passes untrusted input as the session ID to resume.

Prior to version 2.1.179, the Claude Code and Claude Desktop plugin installation flow ran git checkout for a marketplace-pinned commit without checking that the resulting HEAD matched the pinned 40-character SHA. An attacker controlling a plugin repository on a Git host that allows SHA-shaped branch names could create a branch named after the reviewed commit, so checkout selected the branch tip and installed attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the apparently safe hash.

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers forwarded unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens, or a derived Anthropic API key, that were meant to stay outside the sandbox.

Claude Code checked that a target file path was inside the project working directory at permission-check time, but re-resolved the path at write time without repeating the check. An attacker with write access to the shared workspace who could win a race condition could atomically replace a project file with a symlink, redirecting Claude Code's output to an arbitrary file outside the project sandbox. The flaw let a lower-privileged attacker redirect benign edits to sensitive files, such as shell configuration, in a higher-privileged session.

Claude Code selected an API key stored on the device, such as one from an earlier `/login` or written into its configuration, over the user's valid Claude Enterprise or Team sign-in when fetching server-managed settings. If the settings endpoint rejected that key, the session ran without the organization's policy, or kept applying a stale cached copy, while still operating as the organization's account. Exploitation required local access to a device holding such a key, and the no-policy case also required that no managed settings had been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise was affected from version 2.0.68, and Claude for Work (Team) from version 2.1.38.

OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request meant for the owner, so the requested action can proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run.