CVE-2026-25724: @anthropic-ai/claude-code Permission Deny Bypass Through Symbolic Links
Summary
CVE-2026-25724: Claude Code has Permission Deny Bypass Through Symbolic Links. Affects @anthropic-ai/claude-code versions < 2.1.7. Fixed in 2.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code is a package developed by Anthropic AI that provides advanced coding assistance and automation features for developers. It is designed to enhance productivity by offering intelligent code suggestions, error detection, and seamless integration with various development environments. However, a critical vulnerability has been identified that allows unauthorized access to restricted files through symbolic links, potentially compromising sensitive data.
Vulnerability Detail
The vulnerability arises from Claude Code's failure to strictly enforce deny rules specified in the settings.json file when accessing files via symbolic links. This oversight allows a user who has explicitly denied access to certain files, such as /etc/passwd, to still read those files if Claude Code has access to a symbolic link pointing to them. This could lead to unauthorized data exposure and violate user privacy, making it crucial for users to address this issue promptly.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.7
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using symbolic links that point to sensitive files until the package is updated. Additionally, reviewing and adjusting the deny rules in settings.json may help mitigate the risk of unauthorized access.
Conclusion
The CVE-2026-25724 vulnerability in the @anthropic-ai/claude-code package poses a risk of unauthorized access to sensitive files through symbolic links. Users are strongly encouraged to update to version 2.1.7 or later to mitigate this risk. Awareness and prompt action are essential to maintaining the security of your applications.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
The vulnerability allows unauthorized access to restricted files through symbolic links due to improper enforcement of deny rules.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using symbolic links to sensitive files and review your deny rules in settings.json.
The CVSS score for this vulnerability is 2.3, indicating a low severity level.
The vulnerability was reported by a security researcher on HackerOne, specifically by the user with the handle ofirh.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
