npm/@anthropic-ai/claude-code CVE-2026-25725: critical 10, EPSS 0.54%

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

Action: Upgrade @anthropic-ai/claude-code to 2.1.2 or later.

npm i @anthropic-ai/claude-code@2.1.2

Affected

Fixed versions

Sources

• osv: GHSA-ff64-7w26-62rf
• nvd: CVE-2026-25725
• https://github.com/anthropics/claude-code/security/advisories/GHSA-ff64-7w26-62rf
• https://github.com/anthropics/claude-code

CVE-2026-25725 · published 2026-02-06T19:14:33Z · modified 2026-02-06T22:11:17.245533Z · JSON