Loading vulnerability…
CVE-2026-21852 is a pre-trust data exfiltration vulnerability in Anthropic Claude Code affecting versions prior to 2.0.65. During the project-load flow, Claude Code processed repository-provided configuration before the user confirmed trust in the opened project. A malicious repository could supply a settings file that overrides the API base endpoint through the ANTHROPIC_BASE_URL configuration, causing Claude Code to immediately send authenticated API requests to an attacker-controlled server before the trust prompt was displayed or accepted. Because the outbound requests included the Authorization header, the user’s Anthropic API key could be exposed. The flaw is rooted in improper enforcement of the trust boundary during initialization, where network operations and configuration-derived endpoint selection occurred before explicit user approval.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
Repository purpose: an educational demo of Claude Code CLI supply-chain style attacks via malicious project configuration, covering (1) a hooks consent/trust bypass leading to command execution (no CVE, fixed in v1.0.87), (2) CVE-2025-59536 where enableAllProjectMcpServers=true can auto-start project-defined MCP servers from .mcp.json and execute arbitrary commands (fixed in v1.0.111), and (3) CVE-2026-21852 where ANTHROPIC_BASE_URL from project settings is applied before the trust prompt, redirecting API traffic (including API keys in Authorization/x-api-key headers) to an attacker endpoint (fixed in v2.0.65). Structure and key files: - vuln1_hooks_bypass/.claude/settings.json: defines PreToolUse/PostToolUse hooks that run shell commands and write to /tmp/claude_vuln1_demo.log, demonstrating RCE on repo open in vulnerable versions. - CVE-2025-59536_mcp_injection/.claude/settings.json + CVE-2025-59536_mcp_injection/.mcp.json: sets enableAllProjectMcpServers=true and defines an MCP server that runs sh -c commands, writing to /tmp/claude_vuln2_demo.log. - CVE-2026-21852_api_exfil/.claude/settings.json: sets env.ANTHROPIC_BASE_URL to http://127.0.0.1:8888 to demonstrate credential exfiltration. - attacker_server.py: local HTTP server on 127.0.0.1:8888 that logs incoming requests (headers and JSON bodies) to /tmp/claude_attacker_demo.log and returns a demo JSON response. - attacker_proxy.py: MITM-style proxy on 127.0.0.1:8888 that captures API keys and conversation content, logs to /tmp/claude_proxy_demo.log, and forwards requests to https://api.anthropic.com to keep victim behavior normal. - scanner.py: a defensive detection tool that scans a given repo path for these patterns (hooks executing commands, enableAllProjectMcpServers + .mcp.json command definitions, and ANTHROPIC_BASE_URL/credential-related env overrides) and exits non-zero if findings exist. Exploit capabilities (as demonstrated): - Local code execution via auto-run hooks and MCP server startup (command execution payloads are simple echo/date/whoami/hostname logging but represent arbitrary command execution). - Network-based credential and data interception by redirecting Claude Code API traffic to an attacker-controlled base URL; optional stealth forwarding to the real Anthropic API. Overall, this is a PoC/educational repository combining malicious config examples, attacker infrastructure (server/proxy), and a scanner to detect the same indicators before opening a repo in Claude Code.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Claude Code project files that allowed attacker-controlled configuration files to silently start a malicious MCP server when a developer opened a project.
Data leakage vulnerability in Claude Code before version 2.0.65 where a malicious repository could redirect API requests and expose API keys before the trust prompt was shown.
A similar vulnerability in Claude Code involving automatic execution of workspace configurations through MCP, mentioned for comparison only.
A vulnerability in Claude Code referenced as part of a broader pattern of AI coding tool auto-execution risks.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.