ACVE-2026-0002

The configuration

Configuration label

claude-code <999.0.0

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0; fixed 2.1.2)

Matcher

• all
  • harness.id eq "claude-code"
  • harness.version semverRange "<999.0.0"
  • sandbox exists

Why it is exploitable

What the vulnerability is

Claude Code sandbox settings can permit the sandbox-escape condition described by the referenced GHSA. The relevant boundary is the sandbox state at process startup: a later-created settings file is not equivalent to a file that was already present when the harness began. The current seed does not establish a fixed Claude Code release.

Which configuration is exposed

The matcher requires harness.id claude-code, a version below the sentinel <999.0.0, and a present sandbox field. It is deliberately broad because the lockfile records the effective sandbox setting but not the complete startup history. The finding text must therefore be read as requiring confirmation that the relevant settings.json startup-state condition occurred.

How ACVE detects it

ACVE reads harness.id, harness.version, and the existence of sandbox. ACVE cannot see whether settings.json existed at start, whether the sandbox value was enabled or restrictive, what command escaped, or whether an escape was reproduced. The finding is a possible configuration match, not proof of the startup-state prerequisite.

Fix

1. Verify that the sandbox settings file is present and correct before starting Claude Code.
2. Use the most restrictive supported sandbox configuration and do not treat a post-start settings change as evidence that startup was safe.
3. Run grounding before selecting an upgrade target, then upgrade to the confirmed fixed release.

Grounding needed

acve advisory ground must confirm the affected Claude Code range, fixed release, and the startup-state condition required by GHSA-ff64-7w26-62rf.

The broad match is intentional because startup timing is not represented in the lock schema.

References

See references for primary sources.

Underlying CVEs / aliases

• GHSA-ff64-7w26-62rf

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Verify sandbox settings before startup and upgrade to the confirmed fixed release.

Validation

Grounding

• OSV: found; aliases: CVE-2026-25725, GHSA-ff64-7w26-62rf; checked-at 2026-09-20T02:43:27Z
• NVD: not found; checked-at 2026-09-20T02:43:27Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:27Z

References

ADVISORY

• https://github.com/advisories/GHSA-ff64-7w26-62rf

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=GHSA-ff64-7w26-62rf