GHSA-5xjx-9qx6-jcrv: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Claude Codeto a version that resolves this vulnerability.Fixed in 2.1.251
Event History
Frequently Asked Questions
Who is exposed to this issue?
macOS users of Claude Code before 2.1.251 are exposed when attacker-controlled code can run inside the Bash sandbox. This can occur through a malicious repository or dependency script.
What does an attacker need to exploit it?
The attacker needs code execution inside the Bash sandbox and must win a race by replacing an in-workspace parent directory with a symlink after the Edit tool validates the path. User interaction is also required according to the advisory's vector.
What is the impact if exploitation succeeds?
The unsandboxed Edit implementation can overwrite a user-writable file outside the workspace. This can affect the confidentiality, integrity, and availability of impacted files.
What version fixes the issue?
Update Claude Code to version 2.1.251 or later. The issue affects versions prior to 2.1.251.