Symlink Vulnerability in Claude Code Product by Anthropic

CVE-2026-103435

What is CVE-2026-103435?

A vulnerability in Claude Code allows attackers to exploit a time-of-check to time-of-use (TOCTOU) error. Proper validation of the target file path occurs initially, but it does not repeat at the time of writing, permitting an attacker to introduce a symbolic link. This can lead to writing output to unintended locations outside the project sandbox, potentially affecting sensitive files in higher-privileged sessions. To mitigate risks, users should ensure their software is updated to the latest versions.

References