CVE-2026-88968: Claude Code Edit tool can be redirected to overwrite a file outside the workspace on macOS (fixed in 2.1.251)
The National Vulnerability Database (NVD) record says that before Claude Code 2.1.251, on macOS, attacker-controlled code running in the Bash sandbox, such as from a malicious repository or dependency script, can replace an in-workspace parent directory with a symlink after the Edit tool validates its target, so the unsandboxed Edit implementation overwrites a user-writable file outside the workspace; fixed in 2.1.251.
The record
- Kind
- Vulnerability
- Source record
- CVE-2026-88968: Claude Code Edit tool path validation not bound to the directory inode lets code in the Bash sandbox redirect an edit outsid (National Vulnerability Database record)
- Record published
- 2026-11-03
- Posted here
- 2026-11-04
- World
- Software agents · Enterprise work agents
- Controls concerned
- Containment and isolation C-E5; Hard domain restriction C-E2
- Checked
- Checked against its record on 2026-11-04 by a reader who did not draft it; report
verification/reports/SIG-2026-11-04-002-2026-11-04.md.
A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.
What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.
New signals like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly email