Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Thank you to hackerone.com/c_h4ck_0 for reporting this issue.
| Métrique | Valeur | Interprétation |
|---|---|---|
|
AV (Vecteur d'Attaque)
Attack Vector
|
Network (N)
|
Exploit possible à distance via réseau (HTTP, API, etc.) |
|
AC (Complexité d'Attaque)
Attack Complexity
|
Low (L)
|
Peu de conditions requises pour exploiter |
|
PR (Privilèges Requis)
Privileges Required
|
None (N)
|
Aucune authentification requise |
|
UI (Interaction Utilisateur)
User Interaction
|
Unknown (P)
|
Interaction inconnue |
|
S (Périmètre)
Scope
|
Unchanged (U)
|
Impact reste dans le périmètre du composant compromis |
|
C (Impact Confidentialité)
Confidentiality Impact
|
High (H)
|
Divulgation totale d'informations |
|
I (Impact Intégrité)
Integrity Impact
|
High (H)
|
Modification totale des données possible |
|
A (Impact Disponibilité)
Availability Impact
|
High (H)
|
Interruption totale du service possible |
Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code