CVE-2026-39861: 
Claude Code vulnerability analysis and mitigation

CVE-2026-39861 is a sandbox escape vulnerability in Anthropic's Claude Code agentic coding tool, caused by improper symlink handling that allows arbitrary file writes outside the designated workspace. Affecting all versions of the @anthropic-ai/claude-code npm package prior to 2.1.64, the flaw was published on April 20–21, 2026, and reported via HackerOne by researcher philts. It carries a CVSS v4 base score of 7.7 (High) and a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Anthropic Advisory).

The root cause is a combination of CWE-22 (Path Traversal) and CWE-61 (UNIX Symbolic Link Following): Claude Code's sandbox restricted direct writes outside the workspace but did not prevent sandboxed processes from creating symlinks that point to arbitrary external filesystem locations. When Claude Code's unsandboxed process subsequently wrote to a path that resolved through such a symlink, it followed the link and wrote to the external target without user confirmation. Neither the sandboxed command nor the unsandboxed application could independently write outside the workspace, but their combination bypassed both restrictions. Reliable exploitation required the ability to inject untrusted content into a Claude Code context window — for example, via a malicious file or web content processed by the tool — to trigger sandboxed code execution through prompt injection (GitHub Advisory, Anthropic Advisory).

Successful exploitation allows an attacker to write files to arbitrary locations on the host filesystem outside the Claude Code workspace, without any user confirmation prompt. This can lead to arbitrary code execution outside the sandbox — for example, by overwriting shell configuration files, cron jobs, or other executable artifacts — compromising system integrity, confidentiality, and availability. The attack scope is limited to the privileges of the Claude Code process, but given that developers typically run the tool with their own user credentials, sensitive source code, credentials, and system files are all at risk (GitHub Advisory, Anthropic Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.168% (38th percentile), indicating a low but non-negligible probability of exploitation within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control content that enters the Claude Code context window (e.g., via a malicious repository, document, or web page), making it a prompt injection-chained attack rather than a direct network exploit.

1. Identify a target: Locate a developer or organization using Claude Code versions prior to 2.1.64 who processes untrusted content (e.g., open-source repositories, user-supplied documents, or web pages) within their Claude Code sessions.
2. Craft a prompt injection payload: Embed malicious instructions within content that will be ingested into the Claude Code context window — for example, hidden instructions in a README file, source code comment, or web page that instruct Claude Code to execute specific shell commands.
3. Trigger sandboxed code execution: When the victim opens or processes the malicious content with Claude Code, the injected prompt causes Claude Code's sandboxed process to execute attacker-controlled commands.
4. Create a malicious symlink: The sandboxed process runs a command such as ln -s /home/user/.bashrc /workspace/malicious_link to create a symlink inside the workspace pointing to a sensitive file outside it.
5. Trigger unsandboxed write: Craft the prompt injection so that Claude Code's unsandboxed process subsequently writes attacker-controlled content to the symlink path (e.g., /workspace/malicious_link), causing it to follow the symlink and overwrite the target file (e.g., ~/.bashrc) without user confirmation.
6. Achieve code execution: The overwritten file (e.g., shell profile, cron job, or SSH authorized_keys) executes attacker-supplied code the next time it is invoked by the victim user or system (GitHub Advisory, Anthropic Advisory).

• File System: Unexpected symbolic links created inside the Claude Code workspace directory pointing to locations outside the workspace (e.g., ~/.bashrc, ~/.ssh/authorized_keys, cron directories); unexpected modification timestamps on sensitive files outside the workspace coinciding with Claude Code sessions.
• Process: Unusual ln -s or symlink-creation commands spawned as child processes of the Claude Code Node.js process; shell commands writing to paths that resolve outside the workspace directory.
• Logs: Shell history or audit logs (e.g., auditd) showing file write operations to sensitive paths (e.g., /home/<user>/, /etc/) initiated by the Claude Code process or its children; unexpected entries in ~/.bashrc, ~/.profile, or cron files.
• Network: Outbound connections from the developer's workstation to unfamiliar IP addresses or domains shortly after a Claude Code session involving external/untrusted content.

Update Claude Code to version 2.1.64 or later, which resolves the symlink following flaw in the sandbox. Users on the standard Claude Code auto-update channel have already received this fix automatically; only users performing manual updates need to act (GitHub Advisory, Anthropic Advisory). As a general precaution, avoid processing untrusted or externally sourced content (repositories, documents, web pages) with Claude Code until the update is applied. Enable auto-update to ensure future security patches are received promptly, and monitor workspace directories for unexpected symlinks.

The vulnerability was reported through HackerOne by researcher philts and acknowledged by Anthropic in the official security advisory (Anthropic Advisory). Security community coverage appeared on platforms including Bluesky and threat intelligence blogs such as TheCybrDef, with commentary noting the prompt injection chaining aspect as a notable attack pattern for AI coding tools (TheCybrDef). The vulnerability attracted attention as an example of emerging security risks in agentic AI development tools, particularly around sandbox integrity when processing untrusted content.