{"id":"CVE-2026-54316","title":"Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch","summary":"Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch","severity":"medium","cwe":["CWE-183","CWE-200","CWE-515"],"vendor":"anthropic-ai","product":"@anthropic-ai/claude-code","ecosystem":"npm","affected":["@anthropic-ai/claude-code >= 0.2.54, < 2.1.163"],"patched":["@anthropic-ai/claude-code 2.1.163"],"published":"2026-06-17","updated":"2026-06-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fg94-h982-f3mm","references":[{"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm"},{"url":"https://github.com/advisories/GHSA-fg94-h982-f3mm"}],"tags":["ghsa","npm","exploit-available"],"epss":0.0052,"epssPercentile":0.43204,"ingestedAt":"2026-06-29T14:31:47.228Z","exploits":{"github":1,"githubRepos":["https://github.com/InertFluid/cve-2026-54316-lab"],"checkedAt":"2026-09-24T07:53:07.047Z"},"exploitAvailable":true,"slug":"CVE-2026-54316","body":"## Overview\n\nBecause the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.\n\nThank you to hackerone.com/novee for reporting this issue.\n\n## Affected packages\n\n- `@anthropic-ai/claude-code >= 0.2.54, < 2.1.163`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@anthropic-ai/claude-code 2.1.163`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5337,"id":"CVE-2026-54316","ts":1788887267447,"field":"exploit_available","old":"false","new":"true"},{"seq":4220,"id":"CVE-2026-54316","ts":1788886383109,"field":"exploit_available","old":"true","new":"false"},{"seq":2976,"id":"CVE-2026-54316","ts":1788883047100,"field":"exploit_available","old":"false","new":"true"},{"seq":2005,"id":"CVE-2026-54316","ts":1788882451438,"field":"exploit_available","old":"true","new":"false"},{"seq":1081,"id":"CVE-2026-54316","ts":1788881887815,"field":"exploit_available","old":"false","new":"true"}]}