Prior to version 2.1.64, Claude Code’s sandbox allowed the creation of symbolic links that pointed to locations beyond the workspace. When the sandboxed code later wrote to a path within such a link, the unsandboxed component followed the link and wrote to the external target. This combination enabled an attacker to escape the sandbox and overwrite files outside the designated area, potentially leading to code execution beyond the intended boundary.

Anthropic’s Claude Code. Versions earlier than 2.1.64 are affected; users with automatic updates have received the fix, while users performing manual updates must install version 2.1.64 or later.

The CVSS score of 7.7 indicates a high severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to inject untrusted content into a Claude Code context window to trigger sandboxed execution that creates a malicious symlink, after which the unsandboxed process performs the file write. The combination of sandboxed and unsandboxed operations is necessary for the attack path.