{"history":[{"alert":0,"cve":"CVE-2026-103435","id":23023,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00251, \"percentile\": 0.16616}"},{"alert":0,"cve":"CVE-2026-103435","id":20646,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00251, \"percentile\": 0.16584}"},{"alert":0,"cve":"CVE-2026-103435","id":18621,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.00251, \"percentile\": 0.16563}"},{"alert":0,"cve":"CVE-2026-103435","id":16529,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.00251, \"percentile\": 0.16565}"},{"alert":0,"cve":"CVE-2026-103435","id":14507,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.00251, \"percentile\": 0.16563}"},{"alert":0,"cve":"CVE-2026-103435","id":12289,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.00251, \"percentile\": 0.16557}"},{"alert":0,"cve":"CVE-2026-103435","id":10275,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.00251, \"percentile\": 0.16574}"},{"alert":0,"cve":"CVE-2026-103435","id":7824,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.00251, \"percentile\": 0.16595}"},{"alert":0,"cve":"CVE-2026-103435","id":5601,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.00251, \"percentile\": 0.16548}"},{"alert":0,"cve":"CVE-2026-103435","id":3773,"kind":"epss","observed_at":1793679601,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.00251, \"percentile\": 0.16501}"},{"alert":1,"cve":"CVE-2026-103435","id":3717,"kind":"cna","observed_at":1793679601,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-103435\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-10-07T14:39:02.916533Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-07T14:39:13.225Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"@anthropic-ai/claude-code\", \"vendor\": \"Anthropic\", \"versions\": [{\"lessThan\": \"2.1.129\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session.\\n\\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\\n\\nThank you to hackerone.com/c_h4ck_0 for reporting this issue.\"}], \"metrics\": [{\"cvssV4_0\": {\"baseScore\": 7.7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\", \"lang\": \"en\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-61\", \"description\": \"CWE-61 UNIX Symbolic Link (Symlink) Following\", \"lang\": \"en\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-367\", \"description\": \"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-07T12:50:02.572Z\", \"orgId\": \"98a01053-8a31-4f6d-9aa9-252be161adc6\", \"shortName\": \"Anthropic\"}, \"references\": [{\"url\": \"https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch\"}], \"title\": \"Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code\"}}, \"cveMetadata\": {\"assignerOrgId\": \"98a01053-8a31-4f6d-9aa9-252be161adc6\", \"assignerShortName\": \"Anthropic\", \"cveId\": \"CVE-2026-103435\", \"datePublished\": \"2026-10-07T12:50:02.572Z\", \"dateReserved\": \"2026-09-30T15:35:18.777Z\", \"dateUpdated\": \"2026-10-07T14:39:13.225Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"product":"@anthropic-ai/claude-code","vendor":"Anthropic","versions":[{"lessThan":"2.1.129","status":"affected","version":"0","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-103435","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-07T14:39:02.916533Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-07T14:39:13.225Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"@anthropic-ai/claude-code","vendor":"Anthropic","versions":[{"lessThan":"2.1.129","status":"affected","version":"0","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\n\nThank you to hackerone.com/c_h4ck_0 for reporting this issue."}],"metrics":[{"cvssV4_0":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-61","description":"CWE-61 UNIX Symbolic Link (Symlink) Following","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-367","description":"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-07T12:50:02.572Z","orgId":"98a01053-8a31-4f6d-9aa9-252be161adc6","shortName":"Anthropic"},"references":[{"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch"}],"title":"Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code"}},"cveMetadata":{"assignerOrgId":"98a01053-8a31-4f6d-9aa9-252be161adc6","assignerShortName":"Anthropic","cveId":"CVE-2026-103435","datePublished":"2026-10-07T12:50:02.572Z","dateReserved":"2026-09-30T15:35:18.777Z","dateUpdated":"2026-10-07T14:39:13.225Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794457201,"cve":"CVE-2026-103435","description":"Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\n\nThank you to hackerone.com/c_h4ck_0 for reporting this issue.","epss":{"date":"2026-11-12","epss":0.00251,"percentile":0.16616},"epss_checked":1794522003,"first_seen":1793669142,"kev":null,"kev_checked":1794522003,"products":"Anthropic @anthropic-ai/claude-code","references":["https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch"],"score":{"baseScore":7.7,"baseSeverity":"HIGH","provider":"Anthropic","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"solutions":"","state":"PUBLISHED","title":"Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-5j29-h97v-84ch","id":65,"publisher":"Claude Code advisories","title":"Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code"}]}