Vulnerability intelligence

CVE-2025-66479

Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.

CVSS Score

1.8

Low

EPSS — Exploit Probability

0.1%

Riskier than 4% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered May 20, 2026 · latest May 20, 2026

Coverage timeline

Anthropic Silently Patches Claude Code Sandbox Bypass
www.securityweek.com · May 20, 2026