CVE-2026-25725
Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.1.2.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.49%
- CWE
- CWE-501, CWE-668
- Published
- 2026-02-06
- Last modified
- 2026-03-12
Affected products
- anthropics claude-code
Weakness type
Related vulnerabilities
- CVE-2026-44091 — Creation of a new configuration by posting a malicious ID to MQTT
- CVE-2026-65902 — DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
- CVE-2026-49458 — DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- CVE-2026-33828 — Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
- CVE-2026-24153 — NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not...
- CVE-2025-14542 — Command execution in python-utcp allows attackers to achieve remote code execution when fetching a remote Manual from a malicious endpoint
- CVE-2025-64496 — Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
- CVE-2025-49714 — Visual Studio Code Python Extension Remote Code Execution Vulnerability