Claude Code uses a bubblewrap sandbox to isolate its execution. When the settings.json file does not exist at startup, the sandbox incorrectly allows writable access to the parent directory. Malicious code running inside the sandbox can create or modify that file and insert persistent hooks, such as SessionStart commands, that will run with host privileges when Claude Code restarts. The flaw, identified as CWE‑501 and CWE‑668, enables a form of privilege escalation that can compromise the host system.

Versions of Anthropics Claude Code before 2.1.2 are affected. The issue occurs when .claude/settings.json is missing during startup; newer releases mount the file as read‑only and are unaffected. The vulnerability applies to all operating environments where Claude Code is installed locally.

The CVSS base score of 7.7 places this vulnerability in the high severity range, while the EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the ability to run code inside the sandbox, which is typically possible after the sandbox has been compromised or during normal operation of Claude Code. Once the file is created, the attacker gains host privilege execution each time the host restarts.