CVE-2026-39861

CVE-2026-39861 is a critical sandbox escape vulnerability (CVSS 3.1 score of 10.0) affecting Claude Code, an agentic coding tool, in versions prior to 2.1.64. The issue stems from the sandbox failing to prevent sandboxed processes from creating symbolic links (symlinks) that point to locations outside the designated workspace (CWE-22: Path Traversal, CWE-61). When the unsandboxed Claude Code process subsequently writes to a path resolved through such a symlink, it follows the link and writes to arbitrary target locations outside the workspace without user confirmation, bypassing sandbox restrictions.

Exploitation requires an attacker to inject untrusted content into a Claude Code context window, enabling prompt injection to trigger execution of malicious sandboxed code that creates the symlink. Remote attackers with network access (AV:N) can achieve this with low complexity, no privileges, and no user interaction (AC:L/PR:N/UI:N), leading to a scope change (S:C). Successful exploitation allows arbitrary file writes outside the sandbox—neither the sandboxed command nor the unsandboxed app can independently write externally, but their combination enables this—potentially resulting in code execution with the privileges of the unsandboxed process.

The GitHub security advisory (GHSA-vp62-r36r-9xqp) recommends updating to Claude Code version 2.1.64 or later to mitigate the vulnerability. Users on standard auto-update channels have received the fix automatically, while those performing manual updates must apply it explicitly. The vulnerability was published on 2026-04-21.