{"data":{"id":"321e4646-ca3c-4f60-a03a-7ead46fa8b1d","title":"CVE-2026-25725: Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to…","summary":"Claude Code, an agentic coding tool, prior to version 2.1.2 had a flaw in its bubblewrap sandboxing mechanism. When .claude/settings.json did not exist at startup, it was left unprotected, even though the parent directory was writable and .claude/settings.local.json was read-only. Code running inside the sandbox could create this file and inject persistent hooks, such as SessionStart commands, that ran with host privileges when Claude Code restarted.","solution":"Patched in version 2.1.2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25725","publishedAt":"2026-02-06T18:16:00.187Z","cveId":"CVE-2026-25725","cweIds":["CWE-501","CWE-668"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@anthropic-ai/claude-code@< 2.1.2 (fixed: 2.1.2)"],"affectedPackageNames":["@anthropic-ai/claude-code"],"affectedPackageRefs":["npm:@anthropic-ai/claude-code"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code bubblewrap sandbox escape by creating settings.json","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00529,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-ff64-7w26-62rf"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:00.580Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-01-08T21:19:38.381Z","daysToFix":-29,"fixCheckedAt":"2026-10-29T21:41:46.378Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@anthropic-ai/claude-code","fixedVersion":"2.1.2","matchedVersion":"2.1.2","fixReleasedAt":"2026-01-08T21:19:38.381Z","daysToFix":-29,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:41:46.229Z"}]}}