Is CVE-2026-25725 actively exploited?

No active exploitation of CVE-2026-25725 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-25725 be exploited remotely?

Yes. CVE-2026-25725 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-25725?

CVE-2026-25725 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-25725

CRITICAL

CVE-2026-25725

CWE-501Published: February 6, 2026· Updated: Jun 17, 2026

10.0

CVSS v3.1

Official Description

Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.1.2.

NVD Source

Risk Analysis

Claude Code's sandboxing mechanism fails to protect the settings.json file if it is missing at startup, allowing malicious code to inject persistent hooks. This critical vulnerability has a CVSS score of 10.0 and allows for host-level code execution.

This is a remotely exploitable vulnerability, but there is no known public exploit at this time.

Recommended Action

Upgrade Claude Code to version 2.1.2 to ensure proper file protection within the sandbox.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-25725 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.