Claude Code CVE-2026-88968

Exploitation requires all of: a macOS host; a Claude Code version earlier than 2.1.251; attacker-controlled code already executing inside Claude Code's Bash sandbox (delivered via a malicious repository or a dependency/install script); the user invoking the Edit tool against an in-workspace path (the UI:P/user-interaction element); and successfully winning the TOCTOU race by atomically replacing the just-validated in-workspace parent directory with a symlink before the unsandboxed Edit write occurs. Limiting factors that reduce real-world risk: it is macOS-only, it presupposes the attacker has already achieved code execution within the sandbox, the overwrite is confined to user-writable files, and it depends on reliably winning a timing window rather than a deterministic single-shot trigger.

This is a genuine but conditional integrity risk rather than a broad remote threat. The vendor-supplied CVSS 4.0 vector scores 7.7 (High) with AV:N/AC:L/AT:P/PR:N/UI:P and VC:H/VI:H/VA:H, but the mechanism described contradicts a pure network-vector reading: exploitation explicitly requires 'attacker-controlled code to run inside the sandbox,' which is a local code-execution precondition, so the AV:N label likely reflects the malicious-repository delivery path rather than the point of exploitation - verify intent with the vendor. The AT:P (attack-requirements present) metric is grounded in evidence: the GHSA advisory (CWE-367) confirms this is a TOCTOU race requiring the attacker to atomically swap an in-workspace parent directory with a symlink within the time-of-check-to-time-of-use window, so the 'low complexity' feel is offset by the need to win a race. No EPSS score, no CISA KEV listing, and no public exploit reference were provided; the issue was reported privately via HackerOne (Sunder Singh / mahoraga007), so there is no evidence of in-the-wild or widespread exploitation. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a serious sandbox-escape primitive that nonetheless depends on a non-trivial local foothold and is confined to macOS. Net: a real priority to patch for macOS users of affected versions, but not a mass-exploitation emergency.

A developer on macOS opens or runs a malicious repository (or a dependency install/script) under an affected Claude Code version; the attacker's code, executing inside the Bash sandbox, waits for the Edit tool to validate a target path and then atomically replaces a just-validated in-workspace parent directory with a symlink. The unsandboxed Edit implementation then follows the symlink and overwrites an attacker-chosen user-writable file outside the workspace, which can be leveraged (e.g., overwriting a shell rc file) toward broader code execution. No public exploit was identified at time of analysis; the flaw was reported privately through HackerOne.