CVE Intelligence
Analysis AI-assisted

CVE-2026-25725: Anthropic Claude Code: missing sandbox protection for .claude/settings.json

Claude Code versions before 2.1.2 did not protect the .claude/settings.json file under the bubblewrap sandbox when that file was absent at startup. Code running inside the sandbox could create it and register hooks that run with host privileges when Claude Code restarts. The advisory states the issue is patched in version 2.1.2, and NVD rates it critical with a CVSS 3.1 score of 10.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Claude Code is an agentic coding tool. Versions before 2.1.2 had a gap in the bubblewrap sandbox: when .claude/settings.json did not exist at startup, it was left unprotected, even though the parent directory was writable and settings.local.json was read-only.

Impact

  • Code running inside the sandbox could create the file and register persistent hooks, such as SessionStart commands.
  • Those hooks would run with host privileges when Claude Code is restarted.
  • NVD lists a CVSS 3.1 base score of 10. GitHub lists a CVSS 4.0 score of 7.7.

Affected products and versions

  • Anthropic Claude Code, versions before 2.1.2.
  • The record provides no further product or version detail.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Claude Code to version 2.1.2, which the advisory identifies as the patched release.
  • Until the update is applied, review the .claude directories in your projects for settings files and hook definitions you did not create.
  • Treat any code that runs inside the sandbox as able to alter files in writable directories.

Detection guidance

  • Look for unexpected creation of .claude/settings.json in project directories, especially after sandboxed sessions.
  • Review configured hooks and check for commands you do not recognize before restarting the tool.

Limitations of the available information

  • The record contains no fix list entries, no CWE name, and no CVSS 4.0 vector.
  • The record does not describe further conditions or the exact code change in the patch.
  • Sources: the GitHub advisory and the NVD entry.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

According to the record, Anthropic Claude Code versions before 2.1.2 are affected.

What should administrators do?

Update Claude Code to version 2.1.2, the patched release named in the advisory, and review .claude directories for hooks you did not create.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.