Loading vulnerability…
CVE-2026-54316 is an improper access-control vulnerability in Claude Code versions 0.2.54 through 2.1.162. The WebFetch tool pre-approved the Hugging Face hostname as a bare hostname, causing requests to any path on that service—including attacker-controlled model-repository content—to be automatically authorized. Such requests bypassed both the normal permission prompt and --allowedTools restrictions. An attacker who can inject untrusted instructions into a Claude Code context can direct WebFetch to request attacker-controlled repository resources while encoding data available to Claude Code into the requests. Hugging Face records these requests as downloads, creating an out-of-band exfiltration channel.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a self-contained lab for reproducing CVE-2026-54316 / GHSA-fg94-h982-f3mm affecting @anthropic-ai/claude-code. It is not a traditional memory-corruption exploit; instead it demonstrates a web-based prompt-injection and policy-bypass chain. The core issue is that vulnerable Claude Code versions pre-approved the bare hostname `huggingface.co` for WebFetch, allowing any path on that multi-tenant domain to be fetched without a permission prompt. The repository shows how untrusted content can exploit that behavior to exfiltrate local data out-of-band. Repository structure is small and purpose-built: `Dockerfile` builds an isolated lab container with vulnerable Claude Code 2.1.162 installed globally, creates a non-root user, and places a dummy `.env` canary plus permissive Claude settings into `/home/researcher/lab`. `fixtures/canary.env` contains the benign CANARY value used as the stand-in secret. `payloads/untrusted-readme.md` is the actual exploit payload: a markdown prompt-injection sample instructing the agent to read `.env` and fetch one HuggingFace URL per character of the CANARY value. `scripts/make_hf_canary_files.sh` prepares an attacker-controlled HuggingFace repository layout by generating `char_*` files and a `config.json`, enabling reconstruction of the leaked value from HuggingFace download metrics. `README.md` documents both the prompt-bypass proof and the exfiltration workflow. Main exploit capability: induce a vulnerable Claude Code instance to perform unauthorized WebFetch requests to attacker-controlled HuggingFace paths without prompting the user, then use those requests as a covert exfiltration channel. The exploit targets local file contents rather than achieving code execution. It is operational because it includes a concrete payload and supporting infrastructure generation, but it is still a lab/PoC-style reproduction rather than a generalized framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Claude Code vulnerability that enabled API key exfiltration one character at a time via Hugging Face's public download counter.
A vulnerability in Anthropic Claude Code’s harness/workflow that allowed covert exfiltration of API keys via a side channel after prompt-injection-driven compromise of the agent workflow.
A vulnerability in Claude Code that allowed data exfiltration by abusing pre-approved Hugging Face access, enabling attacker-controlled requests that encoded stolen information.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.