Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.1.2.

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.2. It is, therefore, affected by a sandbox escape vulnerability.

The bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks such as SessionStart commands that would execute with host privileges when Claude Code was restarted.
(CVE-2026-25725)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing
    mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at
    startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly
    protected with read-only constraints, settings.json was not protected if it was missing. This allowed
    malicious code running inside the sandbox to create this file and inject persistent hooks (such as
    SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue
    has been patched in version 2.1.2. (CVE-2026-25725)

ID	Name	Product	Family	Type	Severity
305986	Anthropic Claude Code < 2.1.2 Sandbox Escape via settings.json Injection (CVE-2026-25725)	Nessus	Misc.	Local	high
437599	SCA: security update for @anthropic-ai/claude-code (GHSA-ff64-7w26-62rf)	Tenable Cloud Security	SCA Checks	Local	high
437599	SCA: security update for @anthropic-ai/claude-code (GHSA-ff64-7w26-62rf)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-25725

high

Tenable Plugins

high

high

high