PT-2025-49149 · Anthropic · Anthropic Sandbox Runtime

Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-66479

Positive Technologies (AI Summary)

CVSS v4.0

1.8

Low

Base vector

AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Anthropic Sandbox Runtime versions prior to 0.0.16

Description Anthropic Sandbox Runtime is a sandboxing tool designed to enforce filesystem and network restrictions on processes. Prior to version 0.0.16, a flaw in the sandboxing logic allowed sandboxed code to potentially make network requests outside of the intended sandbox environment if the sandbox policy did not define any allowed domains. This occurred because the network sandbox was not properly enforced in such scenarios.

Recommendations Update to version 0.0.16 or later.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-66479

GHSA-9GQJ-5W7C-VX47

Affected Products

Anthropic Sandbox Runtime

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66479.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66479 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66479 · Vendor Advisory
• https://github.com/anthropic-experimental/sandbox-runtime/security/advisories/GHSA-9gqj-5w7c-vx47 · Note
• https://github.com/anthropic-experimental/sandbox-runtime/commit/bea2930cc1db9c73a1b15acf6dc19c5261aec1f3 · Note
• https://reddit.com/r/VulnMatter/comments/1peus6e/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1peorgc/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://twitter.com/CVEnew/status/1996690729897517535 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1pevkbf/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1996851298507903153 · Twitter Post