# Claude Code 2.1.309: sandbox and permission checks could be bypassed

> Claude Code 2.1.309 closes several gaps where sandboxed commands and permission deny rules did not hold as written.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Anthropic
- **Disclosed:** 2026-10-22
- **Affects:** Claude Code
- **Research by:** Claude Code team
- **Primary source:** https://github.com/anthropics/claude-code/releases/tag/v2.1.309
- **Page:** https://theinjection.dev/items/claude-code-2-1-309-sandbox-permission-fixes/

Claude Code 2.1.309 fixes several ways the agent's sandbox and permission rules could be bypassed, including sandboxed Bash commands running shell startup files outside the sandbox and an Edit deny rule that did not block a Bash redirect.

## What happened

Anthropic released Claude Code 2.1.309 on October 22, 2026 with fixes for several ways the agent's sandbox and permission checks could be bypassed. A second release, 2.1.310, shipped on October 23 and fixed two more permission gaps, one on Windows and one in file-read prompts. The release notes describe each fix but name no outside reporter and assign no CVE.

## How it works

Most of these fixes remove a path where the check and the action did not resolve to the same target. Sandboxed Bash on macOS and Linux ran the shell's startup files outside the sandbox before each command, so a planted startup file ran unsandboxed. On macOS, denyWrite glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink, and an Edit(path) deny rule did not block a Bash redirect to that same path in some commands that also held a subshell. On Windows, PreToolUse and PermissionRequest hooks failed open when Git for Windows was not installed.

## Who is affected

Claude Code installs older than 2.1.309 are exposed, on macOS, Linux and Windows, with some fixes specific to a single platform. The users who lose protection are those who rely on the sandbox, on Edit or Bash deny rules, on worktree isolation, or on PreToolUse and PermissionRequest hooks as a control. Windows machines without Git for Windows installed are the ones where the hooks failed open.

## What to do

Update Claude Code to 2.1.310 or later, which carries the fixes from both releases. After updating, re-test any sandbox setting, deny rule or permission hook you depend on, because several of those controls did not hold as written in earlier versions.

## Quick facts

- **Affected:** Claude Code before 2.1.309
- **Fixed in:** 2.1.309, released October 22, 2026, plus two more permission fixes in 2.1.310 on October 23
- **CVE:** None listed in the release notes
- **Attack type:** Sandbox escape and permission check bypass
- **Platforms:** macOS, Linux and Windows, varying by fix
- **Found by:** Not named; published by Anthropic in the Claude Code release notes
- **Status:** Fixed, users must update

## Questions

### Which Claude Code version fixes the sandbox bypasses?

Claude Code 2.1.309, released on October 22, 2026, carries the sandbox and permission fixes, and 2.1.310 on October 23 adds two more, one for Windows hooks and one for file-read prompts. Anthropic's release notes list every change, so updating to 2.1.310 or later is the version that holds all of the fixes described here.

### Is there a CVE for the Claude Code 2.1.309 sandbox fixes?

Anthropic's release notes for Claude Code 2.1.309 and 2.1.310 assign no CVE and name no outside reporter, so there is no official identifier or base score to track. Defenders who need a reference should cite the release notes and the version number. The absence of a CVE does not mean the fixed checks held in earlier versions.

### Do my Claude Code deny rules still work after updating?

Deny rules behave as written in 2.1.309 and later, but several did not before. Anthropic fixed an Edit(path) deny rule that failed to block a Bash redirect to the same path, a Bash permission check that trusted a variable set by a command whose redirect can fail to open, and worktree isolation that accepted some locale-prefixed commands. Re-test the rules you depend on.

### What failed on Windows specifically?

Windows users saw two separate permission failures. PowerShell permission checks auto-approved some Set-Location and cd commands that target the current directory and carry extra arguments, and those now prompt. Separately, PreToolUse and PermissionRequest hooks let a tool call through when Git Bash was missing, which 2.1.309 and 2.1.310 both address for different command shapes.

## Sources

1. [Release 2.1.309](https://github.com/anthropics/claude-code/releases/tag/v2.1.309)
2. [Release 2.1.310](https://github.com/anthropics/claude-code/releases/tag/v2.1.310)