Which versions of Claude Code are affected by CVE-2026-39861?

Claude Code versions prior to 2.1.64 contain a sandbox escape vulnerability enabling arbitrary file writes and potential code execution through symlink exploitation combined with prompt injection.. A patch is available.

Is there a public PoC exploit available for CVE-2026-39861?

Yes, a public proof-of-concept exploit is available for CVE-2026-39861. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-39861?

Within 24 hours: Verify Claude Code deployment version across development teams and identify any instances running versions prior to 2.1.64. Within 7 days: Deploy Claude Code version 2.1.64 or later to all affected systems via standard update channels; confirm successful deployment on 100% of endpoints. Within 30 days: Conduct threat assessment to identify whether any instances processed suspicious prompts during the vulnerability window; review file modification logs on development systems for unauthorized symlink-based writes outside workspace directories.

Claude Code CVE-2026-39861

Q: What is the CVSS score of CVE-2026-39861?

CVE-2026-39861 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-24033 HIGH

Path Traversal (CWE-22)

2026-04-21 GitHub_M

GHSA-vp62-r36r-9xqp

Path Traversal RCE Claude Code

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 18:36 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 02:01 EUVD

Analysis Generated

Apr 21, 2026 - 01:23 vuln.today

CVSS changed

Apr 21, 2026 - 01:22 NVD

7.7 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 01:15 euvd

EUVD-2026-24033

Analysis Generated

Apr 21, 2026 - 01:15 vuln.today

CVE Published

Apr 21, 2026 - 00:56 nvd

HIGH 7.7

DescriptionGitHub Advisory

Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.

AnalysisAI

Sandbox escape in Claude Code versions prior to 2.1.64 enables arbitrary file writes outside the workspace by exploiting symlink handling between sandboxed and unsandboxed processes, potentially leading to code execution. The vulnerability requires prompt injection to trigger malicious sandboxed code execution, creating an exploitable chain where neither component can independently breach the sandbox but their interaction does. EPSS score of 0.08% (23rd percentile) suggests limited real-world exploitation likelihood, and CISA SSVC indicates no known exploitation with non-automatable attack requirements. Version 2.1.64 patches this issue, auto-deployed to standard installations.

Technical ContextAI

Claude Code is an AI-powered agentic coding assistant that executes commands in a sandboxed environment to prevent unauthorized file system access. This vulnerability exploits CWE-22 (Path Traversal) through a symlink-based sandbox escape involving two process types: sandboxed processes that create symbolic links, and unsandboxed processes that write files. The sandbox incorrectly permitted sandboxed processes to create symlinks pointing outside the workspace boundary (e.g., /tmp, /etc, user home directories). When the unsandboxed Claude Code process subsequently wrote to a path within that symlink's tree, it followed the symlink without re-validating workspace boundaries, effectively writing to arbitrary filesystem locations. This represents a classic TOCTOU (Time-Of-Check-Time-Of-Use) variant where privilege separation creates an exploitable window. The CPE cpe:2.3:a:anthropics:claude-code identifies Anthropic's Claude Code as the affected product across all pre-2.1.64 versions.

RemediationAI

Upgrade Claude Code to version 2.1.64 or later immediately. Users on standard auto-update configurations have received the patch automatically and should verify installation version through the application settings. Manual update users must download version 2.1.64+ from the official Anthropic distribution channel and restart the application. Until patching, implement compensating controls: restrict Claude Code usage to trusted, internally-developed codebases only; prohibit opening projects from untrusted sources, public repositories, or AI-generated code; disable automatic code execution features if available; monitor file system activity for unexpected writes outside project directories using filesystem audit tools (auditd on Linux, fsevents on macOS). Note that disabling symlink creation system-wide may break legitimate development workflows involving package managers and build tools. Review Claude Code workspace permissions and ensure it operates under a restricted user account with minimal filesystem privileges as defense-in-depth. Official remediation guidance: https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp.