{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0002",
  "aliases": [
    "GHSA-ff64-7w26-62rf"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Claude Code sandbox settings can permit a sandbox escape",
  "details": "## What the vulnerability is\n\nClaude Code sandbox settings can permit the sandbox-escape condition described by the referenced GHSA. The relevant boundary is the sandbox state at process startup: a later-created settings file is not equivalent to a file that was already present when the harness began. The current seed does not establish a fixed Claude Code release.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `claude-code`, a version below the sentinel `<999.0.0`, and a present `sandbox` field. It is deliberately broad because the lockfile records the effective sandbox setting but not the complete startup history. The finding text must therefore be read as requiring confirmation that the relevant `settings.json` startup-state condition occurred.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, and the existence of `sandbox`. ACVE cannot see whether `settings.json` existed at start, whether the sandbox value was enabled or restrictive, what command escaped, or whether an escape was reproduced. The finding is a possible configuration match, not proof of the startup-state prerequisite.\n\n## Fix\n\n1. Verify that the sandbox settings file is present and correct before starting Claude Code.\n2. Use the most restrictive supported sandbox configuration and do not treat a post-start settings change as evidence that startup was safe.\n3. Run grounding before selecting an upgrade target, then upgrade to the confirmed fixed release.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the affected Claude Code range, fixed release, and the startup-state condition required by `GHSA-ff64-7w26-62rf`.\n\nThe broad match is intentional because startup timing is not represented in the lock schema.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-ff64-7w26-62rf"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=GHSA-ff64-7w26-62rf"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "sandbox-escape"
      ],
      "cwe": [
        "CWE-693"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI04 Agent Identity and Privilege Abuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<999.0.0"
          },
          {
            "field": "sandbox",
            "op": "exists"
          }
        ]
      },
      "fix": {
        "summary": "Verify sandbox settings before startup and upgrade to the confirmed fixed release.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:claude-code",
            "to": "2.1.2",
            "why": "Vendor fix confirmed via OSV."
          },
          {
            "type": "reconfigure",
            "target": "settings:claude-code:sandbox",
            "to": "verified-before-start",
            "why": "Confirm settings are present before starting the harness."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2026-25725",
            "GHSA-ff64-7w26-62rf"
          ],
          "packagesConfirmed": [
            {
              "ecosystem": "npm",
              "name": "@anthropic-ai/claude-code"
            }
          ],
          "fixedVersionsConfirmed": [
            "2.1.2"
          ],
          "cvss": [
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://github.com/anthropics/claude-code/security/advisories/GHSA-ff64-7w26-62rf",
          "note": "Fixed version 2.1.2 confirmed by OSV grounding."
        }
      ]
    }
  }
}