EscapeRoute -- Anthropic Filesystem MCP Sandbox Escape (CVE-2025-53109 & CVE-2025-53110)
Date: 2025-07
Affected: EscapeRoute
Attack vector: rce
Category: real-world
Severity: High
CVE: CVE-2025-53109
CVE-2025-53110
CWE: CWE-22
CWE-59

CVE-2025-53110 (CVSS 7.3): directory containment bypass via naive prefix-matching. CVE-2025-53109 (CVSS 8.4): symlink bypass gave full read/write to any file on the host, including /etc/sudoers. Combined, enabled arbitrary code execution via Launch Agents or cron jobs. All versions prior to 0.6.3 affected.


Mitigations:

Architectural layers (MAESTRO):