Loading vulnerability…
CVE-2026-54316 is an out-of-band data exfiltration vulnerability in Claude Code affecting versions 0.2.54 through 2.1.162. The issue arises because the WebFetch tool treated the bare hostname huggingface.co as pre-approved, causing requests to any path on that domain, including attacker-controlled model repository paths, to bypass the normal permission prompt and avoid intended --allowedTools restrictions. An attacker who can inject untrusted content into a Claude Code context can instruct the agent to fetch attacker-controlled repository resources on Hugging Face and encode sensitive data into those requests. Because Hugging Face records repository downloads server-side, those download events can be used as a covert channel to reconstruct exfiltrated data. Accessible data may include files available to Claude Code, environment variables, and command output. The vulnerability was fixed in Claude Code version 2.1.163.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a self-contained lab for reproducing CVE-2026-54316 / GHSA-fg94-h982-f3mm affecting @anthropic-ai/claude-code. It is not a traditional memory-corruption exploit; instead it demonstrates a web-based prompt-injection and policy-bypass chain. The core issue is that vulnerable Claude Code versions pre-approved the bare hostname `huggingface.co` for WebFetch, allowing any path on that multi-tenant domain to be fetched without a permission prompt. The repository shows how untrusted content can exploit that behavior to exfiltrate local data out-of-band. Repository structure is small and purpose-built: `Dockerfile` builds an isolated lab container with vulnerable Claude Code 2.1.162 installed globally, creates a non-root user, and places a dummy `.env` canary plus permissive Claude settings into `/home/researcher/lab`. `fixtures/canary.env` contains the benign CANARY value used as the stand-in secret. `payloads/untrusted-readme.md` is the actual exploit payload: a markdown prompt-injection sample instructing the agent to read `.env` and fetch one HuggingFace URL per character of the CANARY value. `scripts/make_hf_canary_files.sh` prepares an attacker-controlled HuggingFace repository layout by generating `char_*` files and a `config.json`, enabling reconstruction of the leaked value from HuggingFace download metrics. `README.md` documents both the prompt-bypass proof and the exfiltration workflow. Main exploit capability: induce a vulnerable Claude Code instance to perform unauthorized WebFetch requests to attacker-controlled HuggingFace paths without prompting the user, then use those requests as a covert exfiltration channel. The exploit targets local file contents rather than achieving code execution. It is operational because it includes a concrete payload and supporting infrastructure generation, but it is still a lab/PoC-style reproduction rather than a generalized framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Anthropic Claude Code’s harness/workflow that allowed covert exfiltration of API keys via a side channel after prompt-injection-driven compromise of the agent workflow.
A vulnerability in Claude Code that allowed data exfiltration by abusing pre-approved Hugging Face access, enabling attacker-controlled requests that encoded stolen information.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.