Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.64. It is, therefore, affected by a sandbox escape vulnerability.

  - Claude Code's sandbox did not prevent sandboxed processes from     creating symlinks pointing to locations outside the workspace. When     Claude Code subsequently wrote to a path within such a symlink, its     unsandboxed process followed the symlink and wrote to the target     location outside the workspace without prompting the user for     confirmation. This allowed a sandbox escape where neither the     sandboxed command nor the unsandboxed app could independently write     outside the workspace, but their combination could write to arbitrary     locations, potentially leading to code execution outside the sandbox.
    Reliably exploiting this required the ability to add untrusted content     into a Claude Code context window to trigger sandboxed code execution     via prompt injection. (CVE-2026-39861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent
    sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code
    subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote
    to the target location outside the workspace without prompting the user for confirmation. This allowed a
    sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write
    outside the workspace, but their combination could write to arbitrary locations, potentially leading to
    code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content
    into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on
    standard Claude Code auto-update have received this fix automatically. Users performing manual updates are
    advised to update to version 2.1.64 or later. (CVE-2026-39861)

ID	Name	Product	Family	Severity
310131	Anthropic Claude Code < 2.1.64 Sandbox Escape via Symlink Following (CVE-2026-39861)	Nessus	Misc.	high
440685	SCA: security update for @anthropic-ai/claude-code (GHSA-vp62-r36r-9xqp)	Tenable Cloud Security	SCA Checks	high
440685	SCA: security update for @anthropic-ai/claude-code (GHSA-vp62-r36r-9xqp)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-39861

high

Tenable Plugins

high

high

high