CriticalVulnerabilityLLM-specific
CVE-2026-25725: Claude Code bubblewrap sandbox escape by creating settings.json
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-25725
- Published
- Record updated
- Affected
- @anthropic-ai/claude-code < 2.1.2
- Fixed in
- 2.1.2
- released January 8, 2026, 29 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
Claude Code, an agentic coding tool, prior to version 2.1.2 had a flaw in its bubblewrap sandboxing mechanism. When .claude/settings.json did not exist at startup, it was left unprotected, even though the parent directory was writable and .claude/settings.local.json was read-only. Code running inside the sandbox could create this file and inject persistent hooks, such as SessionStart commands, that ran with host privileges when Claude Code restarted.
Mitigation
Patched in version 2.1.2.
Topics
Related items
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
- HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
- HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
- MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
- MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database