CVE-2026-25725: Claude Code Privilege Escalation Flaw

CVE-2026-25725 Overview

Claude Code is an agentic coding tool developed by Anthropic. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted.

Critical Impact

Malicious code can escape the sandbox by injecting persistent hooks into the unprotected configuration file, enabling arbitrary command execution with host privileges upon application restart.

Affected Products

• Anthropic Claude Code versions prior to 2.1.2 (Node.js)

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25725 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25725

Vulnerability Analysis

This vulnerability represents a Trust Boundary Violation (CWE-501) in Claude Code's sandboxing implementation. The bubblewrap sandbox was designed to isolate potentially malicious code from the host system, but a configuration oversight allowed sandbox escape through file creation rather than file modification.

The core issue lies in the asymmetric protection of configuration files. While .claude/settings.local.json received explicit read-only protection, the primary settings.json file was only protected if it already existed at sandbox initialization. When this file was absent, the sandbox permitted write access to the parent .claude/ directory, enabling malicious code to create a new settings.json with attacker-controlled content.

The attack requires network-delivered malicious content to trigger code execution within the sandbox, combined with user interaction to restart the application. Upon restart, the injected SessionStart hooks execute outside the sandbox context with full host privileges, effectively bypassing all sandbox protections.

Root Cause

The root cause is incomplete enforcement of sandbox boundaries during file system initialization. The bubblewrap configuration logic checked for existing files to apply read-only protections but failed to account for the security implications of allowing file creation in the configuration directory. This represents a Time-of-Check Time-of-Use (TOCTOU) pattern where the absence of a file at startup created a persistent vulnerability window throughout the application lifecycle.

Attack Vector

The attack vector requires an adversary to deliver malicious code that executes within the Claude Code sandbox environment. Once inside the sandbox, the attacker can exploit the unprotected configuration path to write a crafted settings.json file containing malicious SessionStart hooks. These hooks persist across sessions and execute with elevated privileges when the user restarts Claude Code, completing the sandbox escape. The attack is network-accessible but requires user interaction for privilege escalation.

The exploitation mechanism involves:

1. Attacker-controlled code executing within the sandbox
2. Creating .claude/settings.json with injected SessionStart commands
3. User restarting Claude Code (required for privilege escalation)
4. Malicious hooks executing with host privileges outside the sandbox

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25725

Indicators of Compromise

• Unexpected creation or modification of .claude/settings.json file, especially if it previously did not exist
• Presence of SessionStart hooks in settings.json containing suspicious shell commands or scripts
• Unusual process spawning from Claude Code parent process after application restart
• File integrity monitoring alerts for configuration files within the .claude/ directory

Detection Strategies

• Implement file integrity monitoring (FIM) on .claude/settings.json to detect unauthorized creation or modification
• Monitor process trees for Claude Code to identify unexpected child processes executing with host privileges
• Review settings.json content for unfamiliar or suspicious SessionStart hook definitions
• Deploy endpoint detection rules to alert on configuration file creation by sandboxed processes

Monitoring Recommendations

• Enable audit logging for file system operations within user home directories, particularly .claude/ paths
• Configure SentinelOne Singularity to monitor for sandbox escape patterns and suspicious configuration file modifications
• Establish baseline behavior for Claude Code process activity to identify anomalous post-restart execution
• Implement alerting for any process spawned via SessionStart hooks that initiates network connections or accesses sensitive resources

How to Mitigate CVE-2026-25725

Immediate Actions Required

• Upgrade Claude Code to version 2.1.2 or later immediately
• Audit existing .claude/settings.json files for any unauthorized or suspicious SessionStart hooks
• Remove or quarantine any settings.json files containing unrecognized configuration entries
• Restrict write permissions on the .claude/ directory as a temporary measure until patching is complete

Patch Information

Anthropic has addressed this vulnerability in Claude Code version 2.1.2. The patch ensures that settings.json receives proper read-only sandbox protections regardless of whether the file exists at startup. Users should upgrade immediately through their standard package management channels.

For additional details, see the GitHub Security Advisory.

Workarounds

• Pre-create an empty or minimal .claude/settings.json file before running Claude Code to ensure it receives sandbox protection
• Manually apply read-only permissions to the .claude/ directory and its contents when the application is not in use
• Use operating system-level access controls to prevent unauthorized file creation in the configuration directory
• Monitor and periodically audit configuration files for unexpected changes between sessions

# Temporary workaround: Create protected settings.json
mkdir -p ~/.claude
touch ~/.claude/settings.json
chmod 444 ~/.claude/settings.json
# Note: Remove read-only permission before upgrading to allow proper patching