Claude Code — Vulnerability (CVE-2025-59829)
Date: 2025-10
Affected: anthropic/claude_code
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-59829
CWE: CWE-61
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120.


Mitigations:

Architectural layers (MAESTRO):