Claude Code 2.1.251 Closes Several Routes Around the Permission Check

Anthropic’s Claude Code has a new 2.1.251 entry. The CHANGELOG has no date column, but the commit that added the entry is dated August 28, 2026¹.

• Fixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location¹
• Fixed plugin commands declared in a marketplace entry being able to point outside the plugin directory; such paths are now rejected with a path-traversal error¹
• Fixed Grep and Glob not applying Read(...) deny rules to files reached through a symlinked search path¹
• On the feature side, added PreModelSwitch and PostModelSwitch hook events, which can block, confirm, or annotate a model switch¹

The list also covers the Workflow tool reading a scriptPath outside what the session may read before the permission check ran, and Bash permission checks auto-approving commands that assign an arithmetic expression to an integer shell variable, such as OPTIND=1/0¹. The CHANGELOG carries no CVE identifiers or severity ratings, and says nothing about whether any of this was exploited. Still, these are all fixes to cases where reach extended past what was approved, so if you run Claude Code with permissions and hooks tuned to limit where it can operate, the update is worth prioritizing. It is worth reading alongside auto mode becoming the default on August 14, which widened the range of actions that proceed without a prompt in the first place.

Sources

1. Claude Code CHANGELOG - Anthropic official repository (the 2.1.251 entry; the commit adding it is dated August 28, 2026)