CVE-2026-25725
Anthropic Claude Code ≤ 2.1.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-25725 is a high-severity Trust Boundary Violation (CWE-501) vulnerability in Anthropic Claude Code. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Cloud Instance Metadata API (T1552.005); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25725 affects Claude Code, an agentic coding tool, in versions prior to 2.1.2. The vulnerability stems from a flaw in the bubblewrap sandboxing mechanism, which fails to protect the .claude/settings.json configuration file when it does not exist at startup. Although the parent directory is mounted as writable and .claude/settings.local.json is explicitly protected with read-only constraints, the absence of settings.json allows it to be created without restrictions. This enables malicious code executing within the sandbox to inject persistent hooks, such as SessionStart commands, into the file. The issue is rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-501 (Trust Boundary Violation) and CWE-668 (Exposure of Resource to Wrong Sphere).
An attacker can exploit this vulnerability by first executing malicious code inside the sandboxed environment of Claude Code. With no privileges, user interaction, or special access required, and given the network-accessible attack vector and changed scope, exploitation allows creation of the unprotected settings.json file. Upon restarting Claude Code, the injected hooks execute with full host privileges, enabling complete compromise including high confidentiality, integrity, and availability impacts.
The GitHub security advisory (GHSA-ff64-7w26-62rf) confirms the issue has been addressed in Claude Code version 2.1.2, recommending immediate upgrade to mitigate the sandbox escape risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5616
Vulnerability Data
Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and…
more
.claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.1.2.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: claude
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 7 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops resources from being reachable by actors outside the intended control sphere.
Information flow enforcement directly stops trusted and untrusted data from being combined by applying rules that govern allowable data movements and combinations.
Least privilege reduces the set of actors that can reach a resource, limiting wrong-sphere exposure.
Associating explicit security attributes with data objects enables enforcement mechanisms that keep trust levels from being mixed inside structures.
Boundary protection at interfaces prevents resources from being exposed outside authorized spheres.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorizations directly prevents resources from being exposed outside their intended control sphere.
Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.
Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.
Logical segmentation and access controls enforce separation between trust domains, reducing the chance of co-mingled data structures.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.
Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.
Secure development lifecycle mandates separation of trusted and untrusted data flows, directly preventing mixing in the same structure.
Application security requirements include explicit trust-boundary definitions and data classification at interfaces.
Requiring owners to manage the full asset life cycle and remove assets from the inventory upon secure disposal helps prevent resources from being inadvertently exposed outside their intended security sphere.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-668
- V-248823 OL 8 must not have the telnet-server package installed. prevents CWE-668
RHEL 7 (1 rule)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-668
Windows 10 (1 rule)
- V-220967 The Debug programs user right must only be assigned to the Administrators group. prevents CWE-668
Windows 11 (1 rule)
- V-253490 The "Debug programs" user right must only be assigned to the Administrators group. prevents CWE-668
Windows Server 2016 (1 rule)
- V-225079 The Debug programs user right must only be assigned to the Administrators group. prevents CWE-668
Windows Server 2019 (1 rule)
- V-205757 Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. prevents CWE-668
Windows Server 2022 (1 rule)
- V-254500 Windows Server 2022 debug programs user right must only be assigned to the Administrators group. prevents CWE-668