CVE-2025-59829: Claude Code Privilege Escalation Flaw

CVE-2025-59829 Overview

CVE-2025-59829 affects Anthropic Claude Code, an agentic coding tool used by developers to automate code changes. Versions below 1.0.120 do not resolve symbolic links when evaluating permission deny rules. When a user explicitly denies Claude Code access to a file, the agent can still read or modify that file through a symlink pointing to it. This weakness is categorized under CWE-61: UNIX Symbolic Link Following. Anthropic addressed the issue in version 1.0.120, which is delivered automatically to users on standard auto-update.

Critical Impact
An attacker or a misguided agent action can bypass explicit user-configured deny rules and access sensitive files through symlinks, undermining the agent's permission model.

Affected Products

Anthropic Claude Code versions prior to 1.0.120
Deployments running Claude Code on Node.js
Manual-update installations that have not upgraded to 1.0.120

Discovery Timeline

2025-10-03 - CVE-2025-59829 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59829

Vulnerability Analysis

Claude Code enforces file access controls through a permission system that lets users deny the agent read or write access to specific paths. The permission check in versions before 1.0.120 compares the requested path against the deny list without resolving symbolic links. When the agent is asked to open a symlink whose target is a denied file, the check evaluates the symlink path, not the underlying target. The access proceeds because the symlink itself is not on the deny list.

The issue falls under symbolic link following [CWE-61]. It represents a Time-of-Check Time-of-Use style gap between permission evaluation and actual file operation. The impact is limited to confidentiality and integrity of files that the agent has filesystem access to reach through a symlink. Network exploitation requires user interaction because the agent acts on user or model-driven instructions.

Root Cause

The permission enforcement logic canonicalizes paths incompletely. It fails to call a path-resolution routine such as realpath() before matching against deny rules. As a result, /allowed/link -> /denied/secret.env passes the check even though the effective read target is /denied/secret.env.

Attack Vector

Exploitation requires that a symlink to a denied file already exists in a location Claude Code can access, or that the agent is instructed to create or follow one. A malicious repository, prompt injection payload, or untrusted build script can plant such symlinks. When the agent later reads or writes the linked path, the deny rule is bypassed and the sensitive file is exposed to the model context or overwritten. See the Anthropic GitHub Security Advisory GHSA-66m2-gx93-v996 for vendor details.

Detection Methods for CVE-2025-59829

Indicators of Compromise

Unexpected symbolic links inside project directories that point to files outside the workspace, such as ~/.ssh/, ~/.aws/credentials, or .env files
Claude Code file-access log entries referencing paths that appear in the user's configured deny list
Recent Claude Code sessions on versions below 1.0.120 that operated on repositories from untrusted sources

Detection Strategies

Audit workspaces used by Claude Code for symlinks whose targets resolve outside the intended project root
Query the installed Claude Code version across developer endpoints and flag any instance older than 1.0.120
Review agent transcripts for tool calls that read files matching known deny-rule patterns

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux, EDR file-access telemetry on macOS and Windows) for sensitive directories accessed by the Node.js process running Claude Code
Alert on creation of symbolic links inside repositories that resolve to home-directory secrets or system configuration files
Track Claude Code process activity against the deny-list paths to identify bypass attempts even after patching

How to Mitigate CVE-2025-59829

Immediate Actions Required

Upgrade Claude Code to version 1.0.120 or later on every developer workstation and CI runner
Confirm that auto-update is enabled, or run the manual update procedure documented by Anthropic
Remove unexpected symlinks from active project directories before resuming agent sessions

Patch Information

Anthropic fixed the symlink handling flaw in Claude Code 1.0.120. The patched build resolves symbolic links before evaluating permission deny rules, so the underlying target path is matched against the policy. Users on the default auto-update channel received the fix automatically. Refer to the Anthropic GitHub Security Advisory GHSA-66m2-gx93-v996 for the release notes.

Workarounds

Run Claude Code inside a container or sandbox that does not mount sensitive host directories, limiting what any symlink can point to
Restrict the operating-system user running Claude Code so that denied files are unreadable at the filesystem permission layer, not only through the agent's deny list
Avoid opening untrusted repositories with pre-existing symlinks in Claude Code sessions until the client is upgraded

bash

# Verify the installed Claude Code version and update if below 1.0.120
claude --version
npm install -g @anthropic-ai/claude-code@latest

# Scan a workspace for symlinks that escape the project root
find . -type l -exec sh -c 'target=$(readlink -f "$1"); case "$target" in "$PWD"/*) ;; *) echo "external symlink: $1 -> $target";; esac' _ {} \;