CVE-2026-25725: @anthropic-ai/claude-code Persistent Configuration Injection Vulnerability
Summary
CVE-2026-25725: Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json. Affects @anthropic-ai/claude-code versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Claude Code is an advanced coding assistant developed by Anthropic AI, designed to enhance programming efficiency through intelligent suggestions and automation. It operates within a sandboxed environment to ensure that user code runs securely. However, a recent vulnerability has been identified that compromises the integrity of its sandboxing mechanism, specifically related to the handling of configuration files.
Vulnerability Detail
The vulnerability arises from Claude Code's bubblewrap sandboxing mechanism, which inadequately protects the .claude/settings.json configuration file when it is absent at startup. This oversight allows malicious code executed within the sandbox to create the settings.json file and inject persistent hooks, such as SessionStart commands. These hooks can execute with host privileges upon restarting Claude Code, potentially leading to unauthorized access and manipulation of the host system.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can ensure that the .claude/settings.json file exists and is properly secured with appropriate permissions to prevent unauthorized modifications until the package is updated.
Conclusion
The CVE-2026-25725 vulnerability in the @anthropic-ai/claude-code package highlights a significant issue with the handling of configuration files within its sandboxing mechanism. Users are strongly advised to update to version 2.1.2 or later to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you do not update the package, your application remains vulnerable to potential exploitation, which could lead to unauthorized access and execution of malicious code.
While the primary risk is unauthorized access, there is a potential for data loss or corruption if malicious code is executed with host privileges.
The vulnerability was reported by a security researcher from hackerone.com/edbr, contributing to the security of the Claude Code application.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
