CVE-2026-25725

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.1.2.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-501CWE-668

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-257269.8Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number gCVE-2026-257276.5time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses withCVE-2026-257287.5ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulneraCVE-2026-257296.5DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability CVE-2026-25736.4The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-SiCVE-2026-257317.8calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine CVE-2026-257327.5NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata withoutCVE-2026-257335.4Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2026-257344.8Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2026-257354.8Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2026-257364.8Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2026-257379.0Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vu
CVE-2026-25725: Critical severity, CVSS 10.0 | Vulnix