SB2026043033 - Trust Boundary Violation in Claude Code

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026043033

SB2026043033 - Trust Boundary Violation in Claude Code

Published: April 30, 2026

Security Bulletin ID SB2026043033
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Trust Boundary Violation (CVE-ID: CVE-2026-25725)

The vulnerability allows a remote attacker to execute arbitrary code with host privileges.

The vulnerability exists due to trust boundary violation in the .claude/settings.json configuration file handling when malicious code running inside the sandbox creates a missing settings.json file. A remote attacker can inject persistent hooks such as SessionStart commands to execute arbitrary code with host privileges.

Exploitation requires that the settings.json file does not exist when Claude Code starts, and the injected hooks execute when Claude Code is restarted.


Remediation

Install update from vendor's website.

References