GitHub discloses high-severity Claude Code Edit tool flaw, CVE-2026-88968

GitHub published a high severity security advisory for Claude Code's Edit tool on November 9, 2026, disclosing a time-of-check to time-of-use (TOCTOU) race condition that could let an attacker running code inside the sandbox write files outside the intended workspace on macOS. The vulnerability, tracked as CVE-2026-88968, had already been fixed by the time the GitHub Security Advisories entry went live.

The concrete details

• The advisory, titled Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace, carries the identifiers CVE-2026-88968 and GHSA-5xjx-9qx6-jcrv, rated High severity with a CVSS v4 score of 7.7.
• It affects the npm package @anthropic-ai/claude-code in versions before 2.1.251, the version that contains the fix.
• The root cause is a TOCTOU race in the Edit tool's path validation, classified under CWE-59 and CWE-367.
• On macOS, an attacker able to execute code inside Claude Code's sandbox, for example through a malicious repository, could swap a workspace parent directory for a symlink between validation and the write, causing files to be written outside the workspace.
• The flaw was credited to reporter Sunder Singh via HackerOne. It was published to the GitHub Advisory Database on November 9, 2026; the page also shows an initial published date of October 26, 2026, and an NVD publish date of November 3, 2026.

What it means for people who build with AI

Claude Code is one of the most widely used AI coding agents, so a sandbox escape adjacent file write flaw is directly relevant to anyone running untrusted repositories through it, even though the issue is already patched. The attack required an attacker to already be executing code inside the sandbox, but the outcome it enabled, files written outside the intended workspace on macOS, is exactly the kind of boundary violation that agentic coding tools are built to prevent.

What to do next

Anyone running @anthropic-ai/claude-code on macOS before version 2.1.251 should update to 2.1.251 or later, the version where the fix ships.

Sources

• Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace (CVE-2026-88968) (GitHub Security Advisories, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.