CVE-2026-103435: Claude Code TOCTOU Race Condition Vulnerability

CVE-2026-103435 Overview

CVE-2026-103435 is a time-of-check to time-of-use (TOCTOU) vulnerability in Anthropic's Claude Code. The tool validated that a target file path resided within the project working directory during the permission check. It then re-resolved the path at write time without repeating that validation. An attacker with write access to the shared workspace can atomically replace a project file with a symlink between those two steps. Claude Code follows the symlink and writes output to an arbitrary file outside the project sandbox. The flaw is tracked as CWE-22 (Path Traversal) and was reported through HackerOne by c_h4ck_0.

Critical Impact
A lower-privileged attacker can redirect benign file edits performed by a higher-privileged Claude Code session to sensitive targets such as shell configuration files, enabling privilege escalation.

Affected Products

Anthropic Claude Code (versions prior to the patched release)
Deployments using manual update workflows that have not pulled the fix
Shared workspace environments where multiple users have write access

Discovery Timeline

2026-10-07 - CVE-2026-103435 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103435

Vulnerability Analysis

Claude Code enforces a sandbox boundary by checking that any file it intends to modify is contained within the active project working directory. The check and the subsequent write are not performed atomically. Between the check and the write, the resolved path can change on disk.

An attacker with write access to the workspace can swap the target file for a symbolic link pointing outside the sandbox. When Claude Code performs the write, it follows the symlink and emits content to the attacker-controlled destination. Because Claude Code may run in a session with higher privileges than the attacker, the write occurs with those elevated permissions.

Typical abuse scenarios include overwriting shell startup files such as .bashrc or .zshrc, SSH authorized_keys, or application configuration files. Any of these can convert an arbitrary file write into persistent code execution.

Root Cause

The root cause is a missing re-validation of the resolved path at write time. The permission check and the file write operate on independently resolved paths, creating a classic TOCTOU window. Symlink resolution is also permitted during the write step, which turns the race into a reliable arbitrary file write primitive.

Attack Vector

Exploitation requires write access to the shared workspace and the ability to win the race against Claude Code's write operation. The attacker replaces a file that Claude Code is about to modify with a symlink to a sensitive target. Successful exploitation yields integrity and confidentiality impact against files owned by the higher-privileged user running the Claude Code session.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-5j29-h97v-84ch for additional technical context.

Detection Methods for CVE-2026-103435

Indicators of Compromise

Unexpected symbolic links appearing in project working directories, especially where regular files existed previously.
Modifications to sensitive files outside the project directory, such as ~/.bashrc, ~/.zshrc, or ~/.ssh/authorized_keys, correlated in time with Claude Code sessions.
File operations by the Claude Code process whose final targets resolve outside the declared workspace root.

Detection Strategies

Audit filesystem telemetry for symlink() or rename() syscalls targeting files under active Claude Code project paths from accounts other than the session owner.
Correlate Claude Code process writes with the canonical resolved path and alert when the destination escapes the workspace root.
Monitor for sudden changes in file type (regular file to symlink) within monitored repositories.

Monitoring Recommendations

Enable auditd or eBPF-based file integrity monitoring on developer workstations and shared build hosts running Claude Code.
Log and alert on edits to shell configuration files, SSH key files, and CI/CD configuration files outside expected change windows.
Review Claude Code version strings across the fleet to identify hosts still running pre-patch builds.

How to Mitigate CVE-2026-103435

Immediate Actions Required

Update Claude Code to the latest version on every host, particularly where manual update workflows are used.
Verify that hosts configured for auto-update have successfully pulled the fixed release.
Avoid running Claude Code in workspaces writable by lower-privileged or untrusted users until all installations are patched.

Patch Information

Anthropic has released a fixed version of Claude Code. Installations using the standard auto-update channel have already received the patch. Users on manual update workflows must update to the latest version. Refer to the GitHub Security Advisory GHSA-5j29-h97v-84ch for release details.

Workarounds

Restrict workspace permissions so that only the user running Claude Code can write to project directories.
Run Claude Code inside a container or dedicated user account that does not have write access to sensitive files such as shell startup scripts or SSH keys.
Mount project directories with nosymfollow where the operating system supports it, or use filesystem policies that block symlink creation inside tracked project paths.

bash

# Example: tighten permissions on a shared project directory
chown -R claudeuser:claudeuser /srv/projects/myrepo
chmod -R go-w /srv/projects/myrepo

# Verify current Claude Code version and update
claude --version
npm install -g @anthropic-ai/claude-code@latest