LowVulnerability

CVE-2025-66479: Anthropic Sandbox Runtime network sandbox bypass when no domains are allowed

Source: NVD(opens in a new tab)
Identifier: CVE-2025-66479
Published: December 4, 2025
Record updated: October 9, 2026

Affected: @anthropic-ai/sandbox-runtime < 0.0.16
Fixed in: 0.0.16
released November 24, 2025, 10 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.2%

Summary

CVE-2025-66479 affects Anthropic Sandbox Runtime, a tool that enforces filesystem and network restrictions on arbitrary processes at the OS level without a container. Prior to 0.0.16, a bug in the sandboxing logic meant the network sandbox was not properly enforced when the sandbox policy configured no allowed domains. This could allow sandboxed code to make network requests outside the sandbox.

Mitigation

A patch for this was released in v0.0.16.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.2%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.

Weaknesses and techniques

Weakness (CWE): CWE-693

Affected

Packages: @anthropic-ai/sandbox-runtime@< 0.0.16 (fixed: 0.0.16)
Vendors: Anthropic

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Agent
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-66479

First tracked: February 15, 2026 at 08:50 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 80% (self-assessed)

Summary

Mitigation

Related items