CVE-2026-103435

Executive Summary

CVE-2026-103435 is a time-of-check to time-of-use (TOCTOU) path-validation flaw in Claude Code in which the tool validated that a target file path was inside the project working directory at permission-check time but re-resolved that path at write time without repeating validation. An attacker with write access to the shared workspace can win a race and replace a project file with a symlink between check and use, causing Claude Code to write output to an arbitrary file outside the project sandbox. The impact is directed file overwrite and potential code execution in a higher-privileged session (for example, by redirecting benign edits onto shell configuration files).

Technical Analysis

The root cause is a discrepancy between two separate path-resolution operations. At permission-check time, Claude Code resolved the requested target path and confirmed it resided within the project working directory, satisfying the sandbox policy. At write time, the application resolved the same path a second time and performed the write without repeating the containment check. Because the two operations are not atomic with respect to the filesystem, any change to the path's resolution made in the intervening window is honored by the write.

The mechanism is a classic symlink race:

1. The permission check resolves a project-local path (for example, a file name inside the workspace) and confirms it is contained within the working directory.
2. An attacker who can write to the shared workspace atomically replaces that path component with a symbolic link pointing to a file outside the sandbox.
3. The write-time resolution follows the now-symlinked path, and Claude Code writes its output to the link target — an arbitrary location outside the project directory.

Two conditions are required, per the NVD description: (a) the attacker must have write access to the same shared workspace used by the victim, and (b) the attacker must win a race condition against the write operation. The atomic replacement (rename/swap) of a file with a symlink is the standard technique that makes the swap reliable once the timing window is hit. The vulnerability class is CWE-22 (path traversal / improper limitation of a pathname to a restricted directory), realized here as a TOCTOU symlink issue. The tool's own containment logic — not an external interface — is what fails, so the flaw is local to the affected process's filesystem semantics rather than a remotely reachable service defect.

The description does not disclose the specific function names, syscall wrappers, or path-normalization routines involved. No implementation-level detail beyond the check/use sequencing is available, and none is inferred here. There is no available CVSS vector or numeric score, and FIRST.org has not scored the CVE for EPSS; the technical severity must therefore be reasoned from the described conditions rather than from a published metric.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the described vulnerability class (TOCTOU symlink race) and the stated preconditions. It uses no invented function names, endpoints, or parameters.

1. Reconnaissance / target identification. The attacker identifies a shared workspace in which a higher-privileged user runs Claude Code, and determines which project files the victim session is likely to modify (edit targets named in the working directory). The attacker confirms they hold write permission on that workspace.

2. Triggering the flaw class. The attacker monitors for a pending Claude Code write to a chosen project file. At the moment the permission check has passed (path confirmed inside the working directory) but before the write occurs, the attacker atomically replaces the target file with a symbolic link that resolves outside the sandbox — for example, to a sensitive file in the victim's environment. This is a race-condition win against the read-check/write-use window. Because the write-time resolution is not re-validated, the fallback to the link target is not detected.

3. Execution / write outcome. Claude Code performs its write and, following the symlink, overwrites the link target with the tool's output. At the vulnerability-class level this is an arbitrary-file-write primitive constrained to files the victim process can write, and its content is whatever the tool would have written to the project file.

4. Post-exploitation impact. The attacker directs the benign edit onto sensitive files in the higher-privileged session. The NVD description explicitly cites shell configuration files as an example target; overwriting such a file with attacker-influenced content can achieve persistence or code execution when the privileged user next starts a shell or reloads configuration. The blast radius is bounded by the victim's write permissions and by which files the attacker can steer the write toward. Note that success depends on winning a timing race and on workspace write access; both are stated prerequisites, and no technique beyond the described symlink substitution and race is attested.

Impact Assessment

Business impact centers on integrity rather than availability: a lower-privileged actor with workspace access can redirect a privileged session's file writes to arbitrary files the privileged process may write, a privilege-escalation-adjacent outcome. The described example — redirecting edits onto shell configuration — can produce persistence or code execution in the victim's context, which in developer environments may translate to source-code tampering, credential-adjacent file modification, or build pipeline compromise if the affected workspace feeds automated processes.

Blast radius is limited to environments where untrusted or lower-privileged parties share write access to a workspace used by a higher-privileged Claude Code session, and where the attacker can reliably land the race. Single-user, single-trust-domain workstations are largely unaffected in practice. No CVSS subscore vector was published, so severity cannot be quantified from a metric; qualitatively, the combination of local access requirements, a race-condition gate, and a write primitive that can target execution-related files places this in the medium-to-high range for multi-tenant or shared-repository development setups. CISA has not added this CVE to the KEV catalog, and there is no evidence of exploitation in the wild in the provided data.

Detection Guidance

Detection focuses on filesystem behavior (symlink substitution and out-of-tree writes) and process context, since the vulnerability is local and produces no distinctive network signature.

Sigma Rule

title: Symlink Substitution Race Against Claude Code Project Writes
id: 8f3a2c1e-7b64-4d9a-9c2e-1a5b6d7e8f90
status: experimental
description: Detects creation or replacement of a symlink in a project workspace shortly before a write by the Claude Code process, consistent with a TOCTOU symlink race.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103435
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  category: file_event
detection:
  selection_symlink:
    event_type: 'symlink'
  selection_target:
    TargetFilename|contains:
      - '/.bashrc'
      - '/.zshrc'
      - '/.profile'
      - '/.bash_profile'
      - '/.config/'
  condition: selection_symlink and selection_target
falsepositives:
  - Legitimate dotfile management tools creating symlinks
  - Developer dotfile bootstrap scripts
level: medium
tags:
  - attack.t1574
  - cve.2026.103435

YARA Rule

rule CVE_2026_103435_Symlink_Race_Marker
{
    meta:
        author = "valtersit.com"
        description = "Detects artifacts referencing the Claude Code TOCTOU symlink race (CVE-2026-103435) in scripts or logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103435"
        date = "2026-01-01"
    strings:
        $cve = "CVE-2026-103435" ascii nocase
        $a1 = "time-of-check" ascii nocase
        $a2 = "time-of-use" ascii nocase
        $a3 = "symlink" ascii nocase
    condition:
        $cve or (2 of ($a*))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-103435 Claude Code TOCTOU symlink race - workspace marker transfer"; flow:established,to_server; content:"CVE-2026-103435"; nocase; sid:2026103435; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-103435; classtype:attempted-user;)

Elastic Detection

process where event.category == "process" and process.name != null and
  process.args != null and
  process.args : ("*symlink*", "*ln -s*", "*ln -sf*") and
  process.args : ("*.bashrc", "*.zshrc", "*.profile", "*.bash_profile")

Splunk SPL Query

index=edr OR index=sysmon (EventID=11 OR action="file_created")
  (TargetFilename="*.bashrc" OR TargetFilename="*.zshrc" OR TargetFilename="*.profile" OR TargetFilename="*.bash_profile")
  (Image="*claude*" OR CommandLine="*ln -s*" OR CommandLine="*symlink*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, Image, TargetFilename, CommandLine
| where count >= 1
| sort - last_seen

Wazuh OSSEC Rule

<group name="cve_2026_103435,syscheck,">
  <rule id="100435" level="10">
    <if_sid>550</if_sid>
    <field name="file">\.(bashrc|zshrc|profile|bash_profile)$</field>
    <description>CVE-2026-103435: Sensitive shell config file modified in shared workspace - possible TOCTOU symlink race via Claude Code</description>
    <mitre>
      <id>T1574</id>
    </mitre>
  </rule>
  <rule id="100436" level="8">
    <if_sid>550</if_sid>
    <field name="perm">120777</field>
    <description>CVE-2026-103435: Symlink created in monitored project workspace - possible path-swap race</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Update Claude Code to the latest version immediately. Users on standard auto-update have already received the fix; manual-install users must update manually to the newest release.
   • Restrict write access to shared workspaces so that low-privileged or untrusted users cannot modify project files used by higher-privileged sessions.
   • Avoid running Claude Code sessions in workspaces writable by other users or processes where untrusted modification is possible.
   • Where feasible, isolate Claude Code sessions (container, VM, or dedicated low-privileged user) so the blast radius of an out-of-sandbox write is contained.
   • Monitor shell configuration files and other execution-relevant dotfiles for unexpected modification or symlink replacement.

2. Patch / upgrade steps:

   • Allow auto-update to complete and verify the running version post-update.
   • For manual installs, retrieve the latest Claude Code release from the official distribution channel.
   • Because no fixed version string or vendor-advisory URL is available in the source data, confirm the installed version against Anthropic's official release notes before considering the environment remediated.

3. Long-term hardening:

   • Apply a shared-workspace trust model: never commingle privileged and unprivileged write domains in the same project directory.
   • Enforce least privilege for the account running the agent, reducing the set of files a redirected write can reach.
   • Adopt defense-in-depth for agent file writes — post-write verification, file-integrity monitoring on sensitive dotfiles, and immutable or append-only attributes on critical configuration where operationally acceptable.
   • Track vendor advisories for Claude Code and re-evaluate once a CVE-linked patch reference and affected version range are published.

References

• NVD — CVE-2026-103435: https://nvd.nist.gov/vuln/detail/CVE-2026-103435
• Anthropic — Claude Code release/download channel (authoritative source for the fixed version and vendor advisory)
• HackerOne report credit: hackerone.com/c_h4ck_0 (original reporter)
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• Related weakness classes: CWE-367 (Time-of-check Time-of-use Race Condition) and CWE-59 (Improper Link Resolution Before File Access)

No threat actor campaign or exploit-in-the-wild activity is associated with CVE-2026-103435 in the provided data. The CVE is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code has been identified.