Listen to this Post
The vulnerability (CVE-2025-?????) in Anthropic’s experimental sandbox-runtime stems from an incorrect implementation of network allow-list logic. The sandbox’s enforcement mechanism relied on checking configured allowed domains against outgoing connection requests. However, a flawed conditional statement caused the sandbox to skip network enforcement entirely when the policy configuration contained an empty or unset list of allowed domains, rather than defaulting to a “deny-all” state. This logic bug effectively disabled the network containment filter for the sandboxed process if the administrator intentionally or accidentally specified zero permitted domains. Consequently, code executing within this misconfigured sandbox could initiate arbitrary network connections to any host, bypassing the intended isolation. The issue was resolved in version v0.0.16 by correcting the conditional check to enforce a deny-by-default posture even when the allow-list is empty.
Platform: Anthropic Sandbox Runtime
Version: < v0.0.16
Vulnerability: Network Sandbox Escape
Severity: Low
date: 2025-12-04
Prediction: 2025-12-04 (Patched)
What Undercode Say:
Analytics:
Check current sandbox-runtime version npm list @anthropic-ai/sandbox-runtime Audit for vulnerable version npm audit Update to patched version npm update @anthropic-ai/[email protected]
How Exploit:
An attacker with the ability to execute untrusted code within a sandbox instance configured without explicit network allow rules could leverage the bug to perform network reconnaissance, exfiltrate data, or interact with internal services that should be inaccessible from the sandbox.
Protection from this CVE:
Upgrade to v0.0.16.
Impact:
Partial sandbox escape, unauthorized network access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
