Loading vulnerability…
CVE-2026-21852 is a pre-trust data-exfiltration vulnerability in Anthropic Claude Code versions earlier than 2.0.65. A malicious repository can supply project-level configuration that changes the ANTHROPIC_BASE_URL environment setting to an attacker-controlled API endpoint. During project loading, the vulnerable client processes this configuration and initiates authenticated API traffic before the user has confirmed that the project is trusted. The API request can include the user's Anthropic API key in its Authorization header, enabling interception by the attacker-controlled endpoint.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
Repository purpose: an educational demo of Claude Code CLI supply-chain style attacks via malicious project configuration, covering (1) a hooks consent/trust bypass leading to command execution (no CVE, fixed in v1.0.87), (2) CVE-2025-59536 where enableAllProjectMcpServers=true can auto-start project-defined MCP servers from .mcp.json and execute arbitrary commands (fixed in v1.0.111), and (3) CVE-2026-21852 where ANTHROPIC_BASE_URL from project settings is applied before the trust prompt, redirecting API traffic (including API keys in Authorization/x-api-key headers) to an attacker endpoint (fixed in v2.0.65). Structure and key files: - vuln1_hooks_bypass/.claude/settings.json: defines PreToolUse/PostToolUse hooks that run shell commands and write to /tmp/claude_vuln1_demo.log, demonstrating RCE on repo open in vulnerable versions. - CVE-2025-59536_mcp_injection/.claude/settings.json + CVE-2025-59536_mcp_injection/.mcp.json: sets enableAllProjectMcpServers=true and defines an MCP server that runs sh -c commands, writing to /tmp/claude_vuln2_demo.log. - CVE-2026-21852_api_exfil/.claude/settings.json: sets env.ANTHROPIC_BASE_URL to http://127.0.0.1:8888 to demonstrate credential exfiltration. - attacker_server.py: local HTTP server on 127.0.0.1:8888 that logs incoming requests (headers and JSON bodies) to /tmp/claude_attacker_demo.log and returns a demo JSON response. - attacker_proxy.py: MITM-style proxy on 127.0.0.1:8888 that captures API keys and conversation content, logs to /tmp/claude_proxy_demo.log, and forwards requests to https://api.anthropic.com to keep victim behavior normal. - scanner.py: a defensive detection tool that scans a given repo path for these patterns (hooks executing commands, enableAllProjectMcpServers + .mcp.json command definitions, and ANTHROPIC_BASE_URL/credential-related env overrides) and exits non-zero if findings exist. Exploit capabilities (as demonstrated): - Local code execution via auto-run hooks and MCP server startup (command execution payloads are simple echo/date/whoami/hostname logging but represent arbitrary command execution). - Network-based credential and data interception by redirecting Claude Code API traffic to an attacker-controlled base URL; optional stealth forwarding to the real Anthropic API. Overall, this is a PoC/educational repository combining malicious config examples, attacker infrastructure (server/proxy), and a scanner to detect the same indicators before opening a repo in Claude Code.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claude Code data-exfiltration vulnerability.
A Claude Code vulnerability involving API key exfiltration via manipulation of the ANTHROPIC_BASE_URL project configuration.
A vulnerability in Claude Code project files that allowed attacker-controlled configuration files to silently start a malicious MCP server when a developer opened a project.
Data leakage vulnerability in Claude Code before version 2.0.65 where a malicious repository could redirect API requests and expose API keys before the trust prompt was shown.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.