PT-2026-6766 · Anthropic · Claude-Code

Edbr · Published 2026-02-06 · Updated 2026-04-08 · CVE-2026-25725

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 2.1.2

Description Claude Code, an agentic coding tool, had a flaw in its bubblewrap sandboxing mechanism. The mechanism did not adequately protect the .claude/settings.json configuration file if it was absent at startup. The parent directory was writable, and .claude/settings.local.json was read-only, but .claude/settings.json lacked protection when missing. This allowed malicious code within the sandbox to create the file and inject persistent hooks, like SessionStart commands, which would then execute with host privileges upon restarting Claude Code. This issue affects container-based sandbox environments and was observed in similar tools from Google and OpenAI.

Recommendations Update to Claude Code version 2.1.2 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-501

CWE-668

Related Identifiers

CVE-2026-25725

GHSA-FF64-7W26-62RF

Affected Products

Claude-Code

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25725.json · Exploit
• https://osv.dev/vulnerability/GHSA-ff64-7w26-62rf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25725 · Security Note
• https://github.com/anthropics/claude-code · Note
• https://github.com/anthropics/claude-code/security/advisories/GHSA-ff64-7w26-62rf · Note
• https://twitter.com/CVEnew/status/2019847329298194666 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r03op1/resumen_diario_de_vulnerabilidades_09022026 · Reddit Post
• https://twitter.com/IKalendarov/status/2041886316346900489 · Twitter Post
• https://cymulate.com/blog/the-race-to-ship-ai-tools-left-security-behind-part-1-sandbox-escape · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r03p4y/resumen_diario_de_vulnerabilidades_09022026 · Reddit Post
• https://twitter.com/UjlakiMarci/status/2021130566326771802 · Twitter Post
• https://twitter.com/EladBeber/status/2041932431465341232 · Twitter Post
• https://twitter.com/_cvereports/status/2019858658012582142 · Twitter Post
• https://twitter.com/TheHackerWire/status/2020892125395898684 · Twitter Post