gcdRadar
archive/Patch now/AIR-2025-0029
closedclosed 3 Oct 2025Patch now2 Disclosed vulnerabilityAI

CVE-2025-59829: Claude Code symlink permission bypass vulnerability

Claude Code

Claude Code failed to correctly account for symlinks when checking file permission deny rules. A patch has been released in version 1.0.120.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
2.3
EPSS
<0.01 · top 61% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
3 Oct 2025
last update
3 Oct 2025
CVE ids
CVE-2025-59829other records

Timeline · 2

  1. 3 Oct 2025CVE-2025-59829: Claude Code is an agentic coding tool.
  2. 3 Oct 2025CVE-2025-59829: Claude Code permission deny bypass through symlink

Sources · 2

Advisories and databases

  1. 2025-10-03
    CVE-2025-59829: Claude Code is an agentic coding tool.
    NVD · nvd.nist.gov/vuln/detail/CVE-2025-59829
  2. 2025-10-03
    CVE-2025-59829: Claude Code permission deny bypass through symlink
    GitHub Advisory Database · github.com/advisories/GHSA-66m2-gx93-v996

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
Attack on AI
categories
Infrastructure vulnerability
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Anthropic, Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
no technique for these categories
tags
symlink
dates
happened 3 Oct 2025 · first reported 3 Oct 2025
origin
NVD
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 06:33Z · updated 2026-10-18 07:00Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# CVE-2025-59829: Claude Code symlink permission bypass vulnerability

https://gcdradar.vercel.app/incidents/cve-2025-59829-claude-code-symlink-permission-bypass-vulnera · AIR-2025-0029 · closed 2025-10-03

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-10-03
- AI role: Attack on AI
- Products: Claude Code
- CVE ids: CVE-2025-59829
- CVSS: 2.3

## Summary

Claude Code failed to correctly account for symlinks when checking file permission deny rules. A patch has been released in version 1.0.120.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-10-03: CVE-2025-59829: Claude Code permission deny bypass through symlink (https://github.com/advisories/GHSA-66m2-gx93-v996)
- 2025-10-03: CVE-2025-59829: Claude Code is an agentic coding tool. (https://nvd.nist.gov/vuln/detail/CVE-2025-59829)

## Sources

- 2025-10-03 NVD: CVE-2025-59829: Claude Code is an agentic coding tool. https://nvd.nist.gov/vuln/detail/CVE-2025-59829
- 2025-10-03 GitHub Advisory Database: CVE-2025-59829: Claude Code permission deny bypass through symlink https://github.com/advisories/GHSA-66m2-gx93-v996

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed8.7
    Claude Code + SDKs CVE-2025-59536: Claude Code startup trust dialog code injection vulnerability

    Patch now · Disclosed · since 3 Oct 2025 · CVE-2025-59536

    AI
  2. closed7.7
    Claude Code + SDKs CVE-2025-59828: Claude Code vulnerable to arbitrary code execution via Yarn

    Patch now · Disclosed · since 24 Sep 2025 · CVE-2025-59828

    AI
  3. closed8.7
    Claude Code + SDKs CVE-2025-58764: Claude Code command parsing bypasses confirmation prompt

    Patch now · Disclosed · since 10 Sep 2025 · CVE-2025-58764

    AI
  4. closed8.5
    Claude Code + SDKs CVE-2025-59041: Claude Code arbitrary code execution via git config email

    Patch now · Disclosed · since 10 Sep 2025 · CVE-2025-59041

    AI
  5. closed
    Claude Code + SDKs Claude Code Arbitrary Code Execution via Insufficient Startup Warning

    Patch now · Disclosed · since 3 Sep 2025

    AI
  6. closed7.7
    Claude Code + SDKs Claude Code workspace trust dialog bypass via settings file

    Patch now · Disclosed · since 19 Mar 2026 · updated 20 Mar 2026 · CVE-2026-33068

    AI