CVE-2026-88968High· 7.7▾ TwilightClaude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code ru…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.
claude-code < 2.1.251Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88066High· 7.5Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
CVE-2026-112110Medium· 5.8Privileged file deletion in SafeNet Authentication Client SACSrv
CVE-2026-116250Medium· 6.5pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
CVE-2026-112940High· 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…
CVE-2026-106500High· 8.5Backstage is an open framework for building developer portals
CVE-2026-96620Critical· 9.2Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution