CVE-2026-25725: Anthropic Claude Code sandbox escape via configuration injection

CVE-2026-25725 · Severity: medium · CVSS 4 · Published 2026-02-06

Claude Code is a development assistant that runs code in a sandboxed environment to protect the host system. A flaw in the sandbox's file protection allowed malicious code to create and modify a settings configuration file, injecting persistent hooks that execute with full system privileges when the application restarts. This enables complete compromise of the user's system and access to all their data.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-25725 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25725 being exploited in the wild.
How severe is CVE-2026-25725?
Medium severity, with a CVSS score of 4, published 6 February 2026.
Which products and versions are affected?
Anthropic Claude Code < 2.1.2; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.1.2.
Is there a fix for CVE-2026-25725?
Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25725 attacked?
It is attacked over the network.
Am I affected by CVE-2026-25725?
Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @anthropic-ai/claude-code (npm): upgrade to 2.1.2 or later
    npm install @anthropic-ai/claude-code@2.1.2

Technical details

The vulnerability is a sandbox escape caused by improper file protection in bubblewrap's mount configuration. While the .claude/settings.local.json file was explicitly protected with read-only constraints, the .claude/settings.json file was not protected if it did not exist at startup—despite the parent directory being mounted as writable. Malicious code running inside the sandbox could create settings.json and inject persistent hooks (e.g., SessionStart commands) that would execute with host privileges upon application restart. The attack requires the attacker to first achieve code execution within the sandbox (via another vulnerability or malicious extension), but no additional user interaction is needed after that point. The vulnerability affects Claude Code versions prior to 2.1.2, which has been patched.

Affected products

  • Anthropic Claude Code < 2.1.2

Identifiers

  • CVE-2026-25725
  • GHSA-ff64-7w26-62rf

Timeline

  • 2026-02-06: disclosed
  • 2026-02-06: patched: Version 2.1.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.