Threats tagged 'ghsa-5xjx-9qx6-jcrv'

CVE-2026-88968 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Edit tool of Claude Code prior to version 2.1.251. It allows a process running inside Claude Code's Bash sandbox on macOS to overwrite files outside the intended workspace by exploiting a window between pathname validation and use, involving symlink swapping. This requires the attacker to have the ability to execute code inside the sandbox, such as via a malicious repository or dependency script. The issue has been fixed in version 2.1.251, and users on standard auto-update have already received the fix.