Disclosed weakness · no CVE recorded

A Claude Code Bash read could run outside its sandbox without approval

Anthropic · Claude Code

First documented disclosure · Review checkpoint

Summary

Anthropic identified a case where a command classified as read-only ran outside the sandbox without prompting the user.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The release documents the correction. It does not identify a victim or malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Bash tool failed to require approval when switching to execution outside the sandbox in this case.

Conditions required

A session uses the affected Bash read operation in a configuration that expects sandboxing and approval for execution outside it. The vendor did not enumerate the triggering conditions.

Potential impact

The command could run beyond the intended isolation boundary. The vendor did not identify files read, data transmitted or changes made.

Affected versions and configurations

Anthropic did not identify the full affected version range.

Fix and mitigation status

Anthropic lists the fix in Claude Code 2.1.321.

Practical next steps

Use a maintained Claude Code release containing the 2.1.321 fix. Keep sensitive data outside the agent account’s read permissions where possible.

Operating lesson

Treat leaving a sandbox as a separate approval decision even when the operation is read-only.

Evidence and limits

The November 9 release describes a Bash read. The November 6 worktree and command-approval fixes cover different reported behavior.

Sources