Claude Code CVE-2026-103435

Exploitation requires all of: (1) write access to a workspace directory shared between the attacker and a higher-privileged Claude Code session (e.g., a multi-user dev host, container, or CI runner); (2) the ability to atomically replace a validated project file with a symlink in the narrow window between Claude Code's permission-time path validation and its write-time path re-resolution - i.e., winning a TOCTOU race; and (3) a higher-privileged Claude Code session actually performing a write/edit to the targeted path so the symlink is followed. Limiting factors that reduce real-world risk: single-user installations with no shared workspace are not exposed; the attacker must already hold local write access to the workspace; success depends on winning a timing race rather than a deterministic trigger; and the fix is already distributed automatically to users on standard Claude Code auto-update, leaving only manual-update holdouts exposed.

This is a credible but situationally-bounded risk rather than a mass-exploitation emergency. The vendor-supplied CVSS 4.0 vector (7.7 High) lists AV:N/AC:L/PR:N/UI:P with full VC/VI/VA:H, but this score is in tension with the described mechanics: the attack is a TOCTOU symlink race that requires the attacker to already have write access to a shared workspace and to win a race against the victim's write - signals that point to local, authenticated-adjacent, higher-complexity exploitation (AT:P is correctly flagged for the race requirement). The AV:N/PR:N framing is therefore optimistic; realistic exploitation is a local multi-user privilege-escalation primitive, not a remote unauthenticated takeover. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation=none observed, automatable=no (requires winning a timing race and a victim-triggered write), technical impact=total within the redirected-write scope. Net: a real priority to patch for anyone running Claude Code in shared/multi-tenant workspaces, but low likelihood of opportunistic mass exploitation. Note the PR:N claim conflicts with the description's explicit requirement for workspace write access - verify deployment context before trusting the network/unauthenticated framing.

On a shared developer host or CI runner where a low-privileged user and a higher-privileged user both touch the same workspace, the attacker watches for Claude Code to validate a project file path, then atomically swaps that file for a symlink before the write occurs. Claude Code re-resolves and follows the symlink, writing attacker-influenced content to a sensitive file such as the victim's shell configuration (~/.bashrc), yielding code execution in the higher-privileged session. No public exploit code is identified at time of analysis, though the race window is the only non-trivial barrier.