Tools
Claude Code 2.1.265 fixes a plugin path with a backslash bypassing the symlink containment check on macOS and Linux
The 2.1.265 release on 2026-09-08T20:37Z patches a path-handling flaw where a plugin path containing a backslash slipped past the symlink containment check on macOS and Linux, the check that is supposed to keep a plugin from resolving outside its plugin root. The same release fixes the inverse error, plugin directories whose names begin with two dots being wrongly refused as outside the root, and adds a 1 GB cap on tool results written to disk with truncation surfaced in the in-conversation preview. For anyone installing third-party Claude Code plugins, the backslash bypass is the one to upgrade for.
Source
↳ Follow the thread