// ClaudeMEDIUM
CVE-2026-103435 is a time-of-check to time-of-use (TOCTOU) symlink race in Claude Code before version 2.1.129 that allows writes to escape the project directory. An attacker with workspace write access can swap a file with a symlink to redirect output outside the project sandbox. The vulnerability (CVSS 7.7) was fixed in May 2026; no active exploitation has been reported. Developers using older pinned versions, especially in shared environments, should update to 2.1.129 or later.
// Get alerts for Claude