CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

@acampkin/mcc (>=2.1.0, <=2.5.0), @applydigital/claude (>=1.0.0, <=1.2.1) +33 more potentially affected by CVE-2026-103435 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.117)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =1.0.0, =0.0.1, =0.7.5, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.5.2, =0.10.10 and more Source cves: CVE-2026-103435 Source advisory: MEND:CVE-2026-103435...

CVE-2026-103435

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

PT-2026-107492

Name of the Vulnerable Software and Affected Versions Claude Code affected versions not specified Description A time-of-check to time-of-use TOCTOU gap exists where the software validates that a target file path is within the project working directory during the permission check but re-resolves t...

CVE-2026-103435: Improper Limitation of a Pathname to a Restricted Directory

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

HarnessSecurity-Bench: Do Security Mechanisms Really Protect Coding Agent Harnesses?

Coding agent harnesses mediate tool use and authorize actions, yet their security mechanisms and runtime effects remain incompletely characterized. We present HarnessSecurity, the first systematic empirical study and benchmark of open- and closed-source coding agent harnesses. First, we derive a...

Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection

Long-horizon agents consume external content, invoke tools, and modify persistent state. Indirect prompt injection can exploit task-specific context, propagate across causally connected stages, and alter a consequential action while the workflow continues; we term this staged prompt injection. We...

CVE-2026-103012

A flaw was found in claude-code. When retrieving server-managed settings, the application prioritized a locally stored credential over an active organizational account sign-in. If the configuration server rejected the stored credential, a local user could initiate a session that bypasses the...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

Incorrect Behavior Order

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Incorrect Behavior Order via...

@acampkin/mcc (>=2.1.0, <=2.5.0), @applydigital/claude (>=1.0.0, <=1.2.1) +31 more potentially affected by CVE-2026-103012 via @anthropic-ai/claude-code (>=2.0.69, <=2.1.251)

@anthropic-ai/claude-code NPM version =2.0.69, =2.1.0, =1.0.0, =0.0.1, =4.0.0, =0.7.5, =0.6.0-beta.1, =19.24.1, =1.0.0-broken, =0.0.1, =0.4.0, =1.0.29, =1.0.81 and more Source cves: CVE-2026-103012 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-20510289...

CVE-2026-103012

The Claude Code application is vulnerable to a security flaw where it prioritizes locally stored API keys (from previous logins or configurations) over the server-managed settings of a valid Claude Enterprise or Team account. If the settings endpoint rejects the stored key, the session may start ...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

@acampkin/mcc (>=2.1.0, <=2.5.0), @applydigital/claude (>=1.0.0, <=1.2.1) +31 more potentially affected by CVE-2026-103012 via @anthropic-ai/claude-code (>=2.0.69, <=2.1.251)

@anthropic-ai/claude-code NPM version =2.0.69, =2.1.0, =1.0.0, =0.0.1, =4.0.0, =0.7.5, =0.6.0-beta.1, =19.24.1, =1.0.0-broken, =0.0.1, =0.4.0, =1.0.29, =1.0.81 and more Source cves: CVE-2026-103012 Source advisory: MEND:CVE-2026-103012...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier "/login" or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated...

EUVD-2026-89778

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...