GHSA-66m2-gx93-v996

Claude Code permission deny bypass through symlink

Source: GitHub Advisory Database (reviewed) Low CVE-2025-59829

Packages

Ecosystem	Package	Affected	Fixed in
npm	@anthropic-ai/claude-code	< 1.0.120	1.0.120

Details

As written in the advisory (Markdown source, shown as plain text).

Claude Code failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. Thank you to https://hackerone.com/vinai for reporting this issue!

References

External links from the advisory. They lead to third-party sites.

https://github.com/anthropics/claude-code/security/advisories/GHSA-66m2-gx93-v996 web
https://nvd.nist.gov/vuln/detail/CVE-2025-59829 advisory
https://github.com/anthropics/claude-code package