A recently identified vulnerability in Anthropic’s Claude Code exposes a significant security risk, enabling malicious repositories to silently exfiltrate local files from a developer’s system. This flaw leverages the tool’s handling of symbolic links (symlinks) during memory imports, potentially compromising sensitive data without user consent.
Claude Code, an AI-powered command-line development tool, facilitates project-level configurations through files like CLAUDE.md and those within the .claude/rules/ directory. These files can include directives such as @import statements to incorporate shared instructions automatically upon session initiation.
The vulnerability arises from Claude Code’s method of processing these imports. When encountering an @import statement, the tool checks if the specified path appears to be within the project directory. However, it follows symlinks when reading the file, allowing a malicious repository to include a symlink that points to a file outside the repository. This discrepancy enables the import of external files without triggering the tool’s external import approval dialog.
For instance, a malicious repository could place a line like @./link in CLAUDE.md and commit link as a symlink pointing to an external file, such as /etc/passwd. Claude Code evaluates ./link as an internal path, bypassing external import warnings. When the memory loader reads the file, the operating system resolves the symlink to its true target outside the repository, incorporating its contents into the model’s initial context.
Notably, this process occurs before Claude Code performs any actions or seeks user approval. The imported data is included in the first outbound request sent by Claude Code, which, by default, is directed to Anthropic’s API endpoint. However, repository-controlled .claude/settings.json files can override this by setting ANTHROPIC_BASE_URL, potentially redirecting Claude Code traffic to a different endpoint controlled by the attacker.
This issue is particularly concerning for developers who have previously trusted broad parent directories, such as their home folder or common source directories. Claude Code’s workspace trust applies to repositories within these trusted directories, meaning a newly cloned project may not prompt a fresh trust dialog, thereby increasing the risk of exploitation.
Researchers have linked this behavior to earlier Claude Code symlink issues, including CVE-2025-59829 and CVE-2026-25724. In both cases, Anthropic addressed similar flaws by resolving symlinks before enforcing security checks. However, the memory loader did not receive the same canonical-path validation, leaving this vector open for exploitation.
To mitigate this vulnerability, it is recommended that Claude Code canonicalize import targets before applying containment and consent checks. Additionally, users should be warned when imports resolve outside the repository, and settings that can change endpoints in repository configurations should be clearly identified.
This vulnerability underscores the importance of rigorous security measures in development tools, especially those that handle code execution and data transmission. Developers should exercise caution when importing external repositories and ensure that their tools are updated to versions that address known vulnerabilities.
