CVE-2025-66479
Dec. 8, 2025, 6:27 p.m.
1.8
Low
Description
Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.
Product(s) Impacted
| Product | Versions |
|---|---|
| sandbox_runtime |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-693
Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Tags
CVSS Score
CVSS Data - 4.0
- Attack Vector: LOCAL
- Attack Complexity: LOW
- Attack Requirements: PRESENT
- Privileges Required: HIGH
- User Interaction: NONE
- Scope:
- Confidentiality Impact: LOW
- Integrity Impact: NONE
- Availability Impact: NONE
- Exploit Maturity: NOT_DEFINED
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Published: Dec. 4, 2025, 9:16 p.m.
Last Modified: Dec. 8, 2025, 6:27 p.m.
Last Modified: Dec. 8, 2025, 6:27 p.m.
Status : Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
More infoSource
security-advisories@github.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.