Claude Code CVE-2026-39861

Exploitation requires prompt injection capability to manipulate Claude Code's AI agent into executing malicious sandboxed commands-specifically, the attacker must introduce malicious instructions into the context window through code comments, documentation files (README.md, docstrings), or file names that Claude Code processes. The victim developer must actively engage Claude Code's agentic features (code generation, refactoring, analysis) within a workspace containing this poisoned content. User interaction (UI:P in CVSS vector) is mandatory as the developer must invoke Claude Code operations that trigger both symlink creation and subsequent file writes. The vulnerability does NOT affect passive file viewing or installations where agentic code execution is disabled. Attack conditions (AT:P in CVSS vector) indicate deployment-specific factors: exploitation is more reliable when Claude Code has broad filesystem permissions and when projects contain files Claude Code automatically processes (configuration files, package manifests). Default Claude Code installations running with standard user privileges are exploitable. The attack is limited to local privilege escalation scope (SC:N/SI:N/SA:N)-confidentiality, integrity, and availability impacts remain within the developer's existing privilege context rather than compromising system-level resources.

Real-world risk is moderate despite the 7.7 CVSS score. The CVSS:4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) indicates network-accessible attack with low complexity but requiring specific attack conditions (AT:P) and user interaction (UI:P). The key constraint is prompt injection prerequisite: attackers must inject malicious instructions into Claude Code's context window to trigger symlink creation via sandboxed commands, then manipulate subsequent file writes. EPSS score of 0.08% (23rd percentile) reflects this practical exploitation difficulty-significantly lower than typical path traversal vulnerabilities, suggesting limited attacker interest or capability. CISA SSVC assessment confirms no active exploitation, non-automatable attack (requiring social engineering or poisoned repositories), but total technical impact (arbitrary code execution). The high CVSS reflects potential impact (VC:H/VI:H/VA:H) rather than exploitation probability. Primary risk scenarios involve developers opening untrusted projects or AI-generated code containing malicious prompts embedded in comments or documentation. With patch available since version 2.1.64 and automatic update distribution, exposure window is narrow for standard deployments. Manual update users face elevated risk until patching.

An attacker creates a malicious GitHub repository containing seemingly legitimate code with embedded prompt injection payloads in code comments or markdown documentation. When a developer opens this project in Claude Code and interacts with the AI assistant, the injected prompts trigger the agent to execute sandboxed commands that create symlinks pointing from the workspace to sensitive locations like ~/.ssh/authorized_keys or system startup directories. Subsequent Claude Code operations (e.g., 'organize imports' or 'format code') write attacker-controlled content through these symlinks to the target locations, establishing persistence or executing malicious code with the developer's privileges outside the sandbox.