Skip to content

2026-02-03 — Claude Code path restriction bypass → arbitrary file write (GHSA-q728-gf8j-w49r)

What happened: A path restriction control in Claude Code could be bypassed via a ZSH “clobber”/redirection behavior, enabling arbitrary file writes outside the intended workspace.

Why it matters: Any coding agent that can write files is one step away from: - persistence (dropping shell rc files, editor configs, cron jobs) - credential theft (overwriting auth configs) - code execution (writing scripts/binaries in PATH, altering build hooks)

Durable guidance (defensive)

If you run/ship tools that can write files:

  1. Treat “path restrictions” as a security boundary

  2. Enforce in every write primitive (create, overwrite, rename, copy, archive extract).

  3. Canonicalize and validate paths server-side

  4. Resolve realpath() (or equivalent) and enforce:
    • ✅ resolved == workspaceRoot OR resolved.startswith(workspaceRoot + "/")

  5. Reject writes to symlinks (or use O_NOFOLLOW/openat patterns).

  6. Defend against shell redirection tricks

  7. Avoid running file-write operations through a shell.

  8. If a shell is unavoidable, use a restricted shell mode and disable/limit redirections.

  9. Sandbox the agent runtime

  10. Run as a dedicated low-privilege user.

  11. Use filesystem isolation (container/VM) with a read-only host, and a single writable workspace mount.

  12. Add “tamper-evident” logging

  13. Log all writes with: absolute resolved path, uid/gid, hash(before/after), and request provenance.

Status

See the upstream advisory for affected versions and fix details.

References