Claude Code, an agentic coding tool, had a flaw before version 2.1.7 that failed to enforce deny rules defined in settings.json when following symbolic links. An attacker or a malicious user who creates a symlink to a protected file, such as /etc/passwd, can read that file through the tool, thereby bypassing the intended access restrictions. This breach allows unauthorized file disclosure, potentially exposing sensitive system or user information.

The vulnerability affects Anthropic’s Claude Code prior to version 2.1.7, which is distributed as a Node.js application. Users running any earlier release are susceptible unless the configuration explicitly blocks symlink traversal; however, the tool itself does not enforce the deny rules in this context.

The CVSS score is 2.3 and the EPSS score is below 1 percent, indicating a low severity and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access or the ability to create a symbolic link in a directory served by Claude Code; thus, the risk is principally for environments where an attacker can place symlinks into the tool’s working folders. Proper deny rule configuration mitigates the risk, but the bug allows bypass regardless of those settings.