Claude Code Patches a Marketplace Symlink Bypass and a Fail-Open Settings Gap
Claude CodeClaude Code 2.1.267, released September 9, 2026, closed two more paths where a session could act outside a boundary a user or organization had configured. A marketplace entry path containing a backslash could bypass the containment check Anthropic uses for fetched marketplaces on macOS and Linux, echoing a nearly identical plugin-path bypass patched in 2.1.265 the day before. Separately, Anthropic changed what happens when the managed settings governing allowedHttpHookUrls, httpHookAllowedEnvVars, and allowedChannelPlugins cannot be read: instead of quietly admitting everything, Claude Code now admits nothing until the setting can be parsed. Both fixes continue Anthropic's near-daily pattern through August and into September 2026 of narrowing gaps in Claude Code's permission and policy-enforcement layers.
Key Takeaways
- A marketplace path-traversal bug mirrored the plugin symlink bypass patched just a day earlier, suggesting a shared underlying path-normalization flaw.
- Fail-closed replaces fail-open for three managed settings governing HTTP hooks, hook environment variables, and channel plugins, so unreadable config now blocks instead of silently permitting.
- The bypass targeted macOS and Linux specifically, where a backslash in a path is not treated as a directory separator, letting it slip past naive containment checks.
- This is one of several consecutive weeks in which Anthropic has shipped a cluster of permission, sandbox, or policy-enforcement fixes in Claude Code.
- No user action is required; both fixes ship automatically to anyone on Claude Code's standard auto-update channel.
- Organizations relying on
allowedHttpHookUrlsorallowedChannelPluginsto restrict hook behavior should confirm their settings files parse cleanly, since a malformed file now blocks the feature entirely rather than silently allowing it.
Sources & Mentions
1 external resource covering this update
A Second Backslash Bypass in As Many Days
On September 9, 2026, Anthropic shipped Claude Code 2.1.267, one release after closing a nearly identical bug in how plugins are contained. This time the flaw sat in how Claude Code fetches and installs marketplace entries: a path containing a backslash could slip past the containment check meant to keep a fetched marketplace confined to its own directory on macOS and Linux. Left unpatched, a maliciously crafted marketplace entry could have referenced or written files outside the directory Claude Code intended to sandbox it to, the same class of escape Anthropic fixed for plugin paths in version 2.1.265 just one day earlier. The recurrence suggests the underlying path-normalization logic is shared code that needed the same backslash-handling fix applied at a second call site.
Failing Closed Instead of Failing Open
The second fix addresses a more subtle problem: what happens when Claude Code cannot read a piece of managed configuration at all. Three settings in particular, allowedHttpHookUrls, httpHookAllowedEnvVars, and allowedChannelPlugins, are meant to restrict which HTTP hook URLs, environment variables, and channel plugins an organization permits. Previously, if one of these settings was unreadable for any reason, corrupted, missing, or malformed, Claude Code defaulted to admitting everything, effectively disabling the restriction it was supposed to enforce. As of 2.1.267, the same failure mode now admits nothing instead, so administrators get a restriction that is too strict rather than one that silently vanishes.
Part of a Longer Pattern
Both fixes extend a nearly unbroken streak of narrow, permission- and sandbox-related patches Anthropic has shipped through August and into September 2026, following similar clusters in versions 2.1.265, 2.1.261, 2.1.260, 2.1.259, and earlier releases. Neither fix in 2.1.267 is a dramatic standalone exploit on its own, but together with the prior weeks' patches they represent a sustained effort to close every corner where a crafted marketplace entry or a malformed settings file could quietly step around a boundary a user or organization believed was already in place.