CVE-2026-39861 is a critical sandbox escape (CVSS 10.0) in Anthropic's Claude Code before version 2.1.64. A sandboxed process could create symlinks pointing outside the workspace, and the unsandboxed app then wrote through them without asking. Auto-update delivered the fix; manual installs should upgrade to 2.1.64.
What's affected
Claude Code before 2.1.64 is affected. The fixed version is 2.1.64.
The advisory says users on standard auto-update received the fix automatically. Users who update by hand should move to 2.1.64 or later.
It also states that reliable exploitation required getting untrusted content into the context window to trigger sandboxed execution through prompt injection.
How to check if you're exposed
claude --version
Check developer laptops, dev containers and CI images where Claude Code is pinned or installed manually.
What to do now
- Confirm every install reports 2.1.64 or later.
- Update manual or pinned installs, including container images.
- Be cautious about pointing the tool at untrusted repositories or content.
- Keep auto-update enabled where policy allows.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
The record lists CWE-22 (Path Traversal) and CWE-61 (UNIX Symbolic Link Following). The sandbox did not stop symlink creation, and the unsandboxed process followed those links when it wrote. Neither side could write outside the workspace alone, but together they could.
This is a good example of a confused deputy problem, where a privileged component acts on a path prepared by a less privileged one. The record does not flag this CVE as exploited in the wild.
Quick check
Do auto-updating users need to act?
The advisory says they received the fix automatically. Verify the version anyway.
What made exploitation hard?
It needed untrusted content in the context window to trigger sandboxed code through prompt injection.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
