Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-39861 is a high-severity Path Traversal (CWE-22) vulnerability in Anthropic Claude Code. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Adversarial Attacks risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39861 is a critical sandbox escape vulnerability (CVSS 3.1 score of 10.0) affecting Claude Code, an agentic coding tool, in versions prior to 2.1.64. The issue stems from the sandbox failing to prevent sandboxed processes from creating symbolic links (symlinks) that point to locations outside the designated workspace (CWE-22: Path Traversal, CWE-61). When the unsandboxed Claude Code process subsequently writes to a path resolved through such a symlink, it follows the link and writes to arbitrary target locations outside the workspace without user confirmation, bypassing sandbox restrictions.
Exploitation requires an attacker to inject untrusted content into a Claude Code context window, enabling prompt injection to trigger execution of malicious sandboxed code that creates the symlink. Remote attackers with network access (AV:N) can achieve this with low complexity, no privileges, and no user interaction (AC:L/PR:N/UI:N), leading to a scope change (S:C). Successful exploitation allows arbitrary file writes outside the sandbox—neither the sandboxed command nor the unsandboxed app can independently write externally, but their combination enables this—potentially resulting in code execution with the privileges of the unsandboxed process.
The GitHub security advisory (GHSA-vp62-r36r-9xqp) recommends updating to Claude Code version 2.1.64 or later to mitigate the vulnerability. Users on standard auto-update channels have received the fix automatically, while those performing manual updates must apply it explicitly. The vulnerability was published on 2026-04-21.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24033
Vulnerability Data
Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink,…
more
its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Adversarial Attacks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: claude, prompt injection
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V5.3.2V5.2.5
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes special path elements before pathname construction occurs.
Information-flow enforcement on file operations must follow the resolved target rather than the link name, blocking unauthorized data movement via symlinks.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of symlink-following flaws in file-handling code.
Vulnerability identification can discover existing symlink issues but does not prevent or remediate them in code.
Least-privilege access policies can limit damage from symlink attacks but do not address the coding flaw itself.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-61