CVE-2026-39861

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39861", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T19:13:20.379Z", "datePublished": "2026-04-21T00:56:39.062Z", "dateUpdated": "2026-04-21T13:44:49.618Z"}, "containers": {"cna": {"title": "Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-61", "lang": "en", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp"}], "affected": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"version": "< 2.1.64", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T00:56:39.062Z"}, "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later."}], "source": {"advisory": "GHSA-vp62-r36r-9xqp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T13:44:29.934669Z", "id": "CVE-2026-39861", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T13:44:49.618Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T13:44:29.934669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T13:44:44.769Z"}}], "cna": {"title": "Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace", "source": {"advisory": "GHSA-vp62-r36r-9xqp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "anthropics", "product": "claude-code", "versions": [{"status": "affected", "version": "< 2.1.64"}]}], "references": [{"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp", "name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T00:56:39.062Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39861", "state": "PUBLISHED", "dateUpdated": "2026-04-21T13:44:49.618Z", "dateReserved": "2026-04-07T19:13:20.379Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T00:56:39.062Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "claude-code", "vendor": "anthropics", "versions": [{"status": "affected", "version": "< 2.1.64"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "A3919221-55BD-41F3-8E8E-F535A1FE97DA", "versionEndExcluding": "2.1.64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later."}, {"lang": "es", "value": "Claude Code es una herramienta de codificaci\u00f3n ag\u00e9ntica. Antes de la versi\u00f3n 2.1.64, el sandbox de Claude Code no imped\u00eda que los procesos en sandbox crearan enlaces simb\u00f3licos que apuntaban a ubicaciones fuera del espacio de trabajo. Cuando Claude Code posteriormente escrib\u00eda en una ruta dentro de dicho enlace simb\u00f3lico, su proceso no aislado segu\u00eda el enlace simb\u00f3lico y escrib\u00eda en la ubicaci\u00f3n de destino fuera del espacio de trabajo sin solicitar confirmaci\u00f3n al usuario. Esto permit\u00eda un escape de sandbox donde ni el comando en sandbox ni la aplicaci\u00f3n no aislada pod\u00edan escribir de forma independiente fuera del espacio de trabajo, pero su combinaci\u00f3n pod\u00eda escribir en ubicaciones arbitrarias, lo que podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo fuera del sandbox. La explotaci\u00f3n fiable de esto requer\u00eda la capacidad de a\u00f1adir contenido no confiable en una ventana de contexto de Claude Code para activar la ejecuci\u00f3n de c\u00f3digo en sandbox mediante inyecci\u00f3n de prompt. Los usuarios con la actualizaci\u00f3n autom\u00e1tica est\u00e1ndar de Claude Code han recibido esta correcci\u00f3n autom\u00e1ticamente. Se aconseja a los usuarios que realizan actualizaciones manuales actualizar a la versi\u00f3n 2.1.64 o posterior."}], "id": "CVE-2026-39861", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39861", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T13:44:29.934669Z", "version": "2.0.3"}}]}, "published": "2026-04-21T01:16:06.647", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-61"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.64)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "claude-code", "source": "cna", "vendor": "anthropics"}, "product": "claude_code", "vendor": "anthropics"}], "analysis": {"en": {"generated_at": "2026-04-21T23:09:52.822263+00:00", "value": {"mitigation_remediation": ["Verify that automatic updates are enabled so the latest fix is installed.", "If you perform manual updates, upgrade to version\u202f2.1.64 or later immediately.", "Review and limit untrusted input in Claude\u202fCode context windows to prevent prompt injection that could create malicious symlinks."], "summary": {"action": "Immediate update", "impact": "Sandbox escape permitting arbitrary file writes outside the workspace"}, "threat_synthesis": {"affected_systems": "Anthropic\u2019s Claude\u202fCode. Versions earlier than\u202f2.1.64 are affected; users with automatic updates have received the fix, while users performing manual updates must install version\u202f2.1.64 or later.", "description_and_impact": "Prior to version 2.1.64, Claude\u202fCode\u2019s sandbox allowed the creation of symbolic links that pointed to locations beyond the workspace. When the sandboxed code later wrote to a path within such a link, the unsandboxed component followed the link and wrote to the external target. This combination enabled an attacker to escape the sandbox and overwrite files outside the designated area, potentially leading to code execution beyond the intended boundary.", "risk_and_exploitability": "The CVSS score of\u202f7.7 indicates a high severity. The EPSS score is <\u202f1%, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to inject untrusted content into a Claude\u202fCode context window to trigger sandboxed execution that creates a malicious symlink, after which the unsandboxed process performs the file write. The combination of sandboxed and unsandboxed operations is necessary for the attack path."}}}}, "created": "2026-04-21T02:30:25.668862+00:00", "updated": "2026-04-21T23:15:03.120722+00:00", "vendors": ["anthropics", "anthropics$PRODUCT$claude_code"]}