Loading vulnerability…
Claude Code WebFetch Authorization Bypass and Covert Data Exfiltration
Claude Code versions 0.2.54 through 2.1.162 contain an authorization bypass in the WebFetch tool. Pre-approval of the bare Hugging Face hostname extends to all repository paths, including attacker-controlled resources, allowing requests without permission prompts or enforcement of --allowedTools restrictions. An attacker who injects untrusted instructions into the agent's context can induce requests that encode accessible sensitive information. Hugging Face's server-side download counters provide a covert out-of-band channel through which the attacker can reconstruct that information. Version 2.1.163 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability compromises confidentiality by allowing exfiltration of data accessible to Claude Code, including file contents, environment variables, command output, and API credentials. Demonstrated exploitation leaked an API key one character at a time through public download counters. Stolen credentials could enable further access according to their permissions; this vulnerability alone does not establish arbitrary code execution.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted content from entering Claude Code context windows, particularly content supplied through public issues or pull requests. Review workflows that automatically process such inputs and minimize the permissions of credentials available to the agent. Do not rely on --allowedTools restrictions to block the affected WebFetch requests.
Patch, then assume compromise.
Upgrade @anthropic-ai/claude-code to version 2.1.163 or later. Standard auto-update installations have received the fix; manually maintained installations require an explicit update.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.