What is the CVSS score of CVE-2026-25725?

CVE-2026-25725 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Docker are affected by CVE-2026-25725?

Claude Code versions prior to 2.1.2 contain a critical sandbox escape vulnerability (CVSS 10.0) that could allow attackers to access sensitive configuration data and potentially execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-25725?

Within 24 hours: Inventory all Claude Code deployments and identify systems running versions prior to 2.1.2; disable Claude Code if business-critical operations depend on it. Within 7 days: Implement network segmentation to isolate affected systems; enable detailed logging and monitoring for suspicious activities; contact Anthropic for patch timeline. Within 30 days: Apply vendor patch immediately upon release; validate sandbox functionality post-patch; conduct security review of affected systems for indicators of compromise.

Docker CVE-2026-25725

CRITICAL

Trust Boundary Violation (CWE-501)

2026-02-06 security-advisories@github.com

GHSA-ff64-7w26-62rf

Privilege Escalation Code Injection RCE Docker Linux AI / ML Claude Code

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 06, 2026 - 18:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.json configuration file when it did not exist at startup. While the parent directory was mounted as writable and .claude/settings.local.json was explicitly protected with read-only constraints, settings.json was not protected if it was missing. This allowed malicious code running inside the sandbox to create this file and inject persistent hooks (such as SessionStart commands) that would execute with host privileges when Claude Code was restarted. This issue has been patched in version 2.1.2.

AnalysisAI

Claude Code prior to version 2.1.2 has a CVSS 10.0 sandbox escape in the bubblewrap sandboxing mechanism, allowing code execution outside the intended sandbox boundary.

Technical ContextAI

Claude Code < 2.1.2 has a CWE-501 trust boundary violation in its bubblewrap sandboxing mechanism that allows code executed within the sandbox to escape and run with the full privileges of the Claude Code process.