Claude Code symlink race lets file writes escape the project directory (CVE-2026-103435)
CVE-2026-103435 (CVSS v4.0 7.7) is a symlink race in Claude Code before 2.1.129, fixed in May 2026, that can redirect a write outside the project. No exploitation reported.
· 4 min