Act active

Claude Code CVE-2026-39861: sandbox escape via symlink

2026-10-10 16:14 UTC · HN (cve) · read the source ↗ #cve #sandbox-escape #developer-tools

Engineer — Act: A public PoC is available for this sandbox escape in Claude Code; any team running Claude Code in dev workflows or CI should update to the patched release listed in GHSA-vp62-r36r-9xqp immediately.
SOC/IR — Skip
Leader — Skip
Signals: CVE-2026-39861 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.