Claude Code Edit tool race allows writes outside workspace (GHSA-5xjx-9qx6-jcrv)

First seen Nov 9 Updated Nov 10, 17:18 UTC Heat 40 high evidence

HighCVE-2026-88968GHSA-5xjx-9qx6-jcrv@anthropic-ai/claude-code (npm)Affected < 2.1.251 · Fixed in 2.1.251Advisory

GitHub published an advisory for a time-of-check to time-of-use race in the Claude Code Edit tool. A process in the macOS Bash sandbox could swap a workspace parent directory for a symlink after validation, so the unsandboxed Edit wrote to a file outside the workspace.

What to do: Upgrade @anthropic-ai/claude-code to 2.1.251 or later.
Who should care: Claude Code users on macOS, especially those who open untrusted repositories.

Why it matters: Claude Code versions before 2.1.251 on macOS let sandboxed code overwrite files outside the workspace, so manual installs need updating.

Key facts

Affected: @anthropic-ai/claude-code npm versions below 2.1.251; Patched in 2.1.251

Timeline

Official

Nov 9, 22:42 UTC18h ago
GHSA-5xjx-9qx6-jcrv: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspacegithub.com · GitHub Advisory

Evidence

High evidence: the claim comes from an official source (the company or project itself), or at least two independent sites reported it.

Details written Nov 10, 16:10 UTC from the sources listed above.