MediumVulnerabilityLLM-specific
GHSA-fg94-h982-f3mm: Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
- Identifiers
- CVE-2026-54316GHSA-fg94-h982-f3mm
- Published
- Record updated
- Affected
- @anthropic-ai/claude-code >= 0.2.54, < 2.1.163
- Fixed in
- 2.1.163
- released June 4, 2026, 13 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
Claude Code auto-approved any path on the huggingface.co domain for the WebFetch tool because the bare hostname was pre-approved, bypassing the permission prompt and --allowedTools restrictions. An attacker who can inject untrusted content into a Claude Code context can direct WebFetch requests to attacker-controlled repository files, which HuggingFace counts as downloads server-side, creating an out-of-band channel to exfiltrate data Claude can access, such as files, environment variables, or command output. Exploitation requires the ability to add untrusted content into the context window.
Mitigation
Users on standard Claude Code auto-update have already received the fix; users performing manual updates are advised to update to the latest version.
Related items
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
- HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
- HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
- HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
- MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database