Anthropic Claude Code advisory GHSA-5j29-h97v-84ch

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsClaude Code write-time symlink race escaped the project path: Anthropic disclosed a TOCTOU flaw in Claude Code before 2.1.129 where a workspace writer could replace a checked project path with a symlink and redirect the eventual write outside the project.

  GitHub security advisory, Description and Affected versions.

• supportsClaude Code write-time symlink race escaped the project path: Anthropic lists 2.1.129 as the patched version for GHSA-5j29-h97v-84ch.

  GitHub advisory, Patched versions.

• supportsClaude Code write-time symlink race escaped the project path: The advisory identifies CVE-2026-103435 and requires both attacker write access to the shared workspace and winning a write-time race. Anthropic says standard auto-update users had already received the fix.

  Description; CVE ID; Affected versions and Patched versions.