What is the CVSS score of EUVD-2025-201249?

EUVD-2025-201249 has a CVSS 4.0 base score of 1.8 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Anthropic Sandbox Runtime are affected by EUVD-2025-201249?

CVE-2025-66479 is a low-severity vulnerability in Anthropic Sandbox Runtime (CVSS 1.8).. A patch is available.

Is there a public PoC exploit available for EUVD-2025-201249?

Yes, a public proof-of-concept exploit is available for EUVD-2025-201249. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-201249?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Anthropic Sandbox Runtime EUVD-2025-201249

| CVE-2025-66479 LOW

Protection Mechanism Failure (CWE-693)

2025-12-04 security-advisories@github.com

GHSA-9gqj-5w7c-vx47

RCE

1.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

1.8 LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201249

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 21:16 nvd

LOW 1.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

35 npm packages depend on @anthropic-ai/sandbox-runtime (34 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.0.16.

DescriptionGitHub Advisory

Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.

AnalysisAI

A remote code execution vulnerability in Anthropic Sandbox Runtime (CVSS 1.8) that allows sandboxed code. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

CWE-693 (Protection Mechanism Failure). Affects Anthropic Sandbox Runtime.

RemediationAI

Monitor vendor channels for patch availability.

EUVD-2025-201249 vulnerability details – vuln.today

Back