Multiple Claude Code permission and sandbox bypass vulnerabilities patched
A batch of CVEs disclosed in February 2026 described flaws in Anthropic's agentic coding tool Claude Code, including insufficient WebFetch trusted-domain validation, Bash/ZSH and find command parsing bypasses, symlink deny-rule bypass, and a bubblewrap sandbox gap allowing persistent hook injection; a related CVE covered cross-client response data leaks in the MCP TypeScript SDK. All issues were fixed in subsequent releases.
Disclosed 3 February 2026 · Record updated 13 September 2026
Impact
Attackers able to inject untrusted content into a Claude Code context could bypass user confirmation prompts and directory write protections, write to protected folders such as .claude, read files explicitly denied in settings.json via symlinks, inject persistent hooks executing with host privileges, and trigger requests to attacker-controlled domains enabling potential data exfiltration.
Our coverage
No articles linked to this incident yet.
Sources
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-24052
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-24053
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-24887
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-25536
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-25722
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-25723
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-25724
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-25725