CVE-2026-42074 is a sandbox bypass in OpenClaude, a coding agent command line tool, scored CVSS 9.8 (critical). The sandbox switch is part of the shell tool's input, so a prompt-injected model can turn it off. Upgrade to OpenClaude 0.5.1, and turn off unsandboxed commands in settings.
What's affected
The NVD record lists OpenClaude versions before 0.5.1 and says the issue is patched in 0.5.1. The GitHub advisory is less clear. It lists the affected version as latest and patched versions as none, which was true when it was written. The record's 0.5.1 is the figure to use, and the project's pull request 778 and release notes are the place to confirm.
The weak point needs the default configuration. The advisory says the setting that allows unsandboxed commands defaults to true.
How to check if you're exposed
- Find how OpenClaude was installed and its version. For an npm global install:
npm ls -g openclaude
- Check the version your team uses in project tooling, containers and CI images, and compare it with 0.5.1.
- Look at your OpenClaude settings for the sandbox section and the
allowUnsandboxedCommandsvalue. If it is missing, the advisory says it is treated as true. - Note where the tool runs. A developer laptop with SSH keys and cloud credentials has far more at stake than a disposable container.
What to do now
- Upgrade to OpenClaude 0.5.1 or later everywhere it is installed.
- Set
allowUnsandboxedCommandsto false in settings. Per the code quoted in the advisory, the bypass flag is only honored when that setting is true. - Run agents in containers or virtual machines with no access to your real credentials, and mount only the project folder.
- Do not feed the agent untrusted text, such as web pages, issues or files from unknown sources, without reviewing what it plans to run.
- Keep secrets out of the environment where the agent runs, and use short lived tokens.
- Confirm the fix in the release notes, since the advisory page itself did not list a patched version.
Why it matters
The classes are CWE-284, improper access control, and CWE-306, missing authentication for a critical function. The project's own threat model says the model is not a trusted principal and that prompt injection can steer it. Yet a parameter named dangerouslyDisableSandbox was part of the input that the model fills in, and the check that decides whether to use the sandbox trusted it.
That turns a content injection into host level command execution. The model reads text from many places, so an attacker only needs to get instructions in front of it. They do not need access to your machine. The sandbox was the barrier against that, and the model could remove it.
The design lesson applies beyond this tool. A security control should never be an option the controlled party can set. Decisions about the sandbox belong to the person or the configuration, not to the model's output.
The KEV flag is false, and I found no report of exploitation in the wild. The advisory includes a unit test and an integration scenario, so the weakness is easy to confirm in affected versions.
Coding agents are now part of the software supply chain, because they run commands and pull in packages. Keep them in your inventory and check their versions as you would any other dependency, for example with the free in-browser dependency scan.
Try it yourself
An inventory lists the tools and packages in your projects, including agent tooling, so you can find stale versions.
Click through it at your own pace, or open it full screen.
Quick check
Can I rely on the sandbox setting alone?
It reduces the risk according to the advisory code, but upgrading to 0.5.1 is the actual fix. Use isolation as well, because a prompt-injected model is the threat.
Why do the record and advisory disagree on the patch?
The record says patched in 0.5.1, while the advisory page lists no patched version. Confirm against the project release notes.
Sources
Last reviewed: 19 October 2026.
