---
id: CVE-2026-54316
title: >-
  Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain
  in WebFetch
summary: >-
  Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain
  in WebFetch
severity: medium
cwe:
  - CWE-183
  - CWE-200
  - CWE-515
vendor: anthropic-ai
product: '@anthropic-ai/claude-code'
ecosystem: npm
affected:
  - '@anthropic-ai/claude-code >= 0.2.54, < 2.1.163'
patched:
  - '@anthropic-ai/claude-code 2.1.163'
published: '2026-06-17'
updated: '2026-06-17'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fg94-h982-f3mm'
references:
  - url: >-
      https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm
  - url: 'https://github.com/advisories/GHSA-fg94-h982-f3mm'
tags:
  - ghsa
  - npm
  - exploit-available
epss: 0.0052
epssPercentile: 0.41746
ingestedAt: '2026-06-29T14:31:47.228Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/InertFluid/cve-2026-54316-lab'
  checkedAt: '2026-09-26T09:05:49.431Z'
exploitAvailable: true
---

## Overview

Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/novee for reporting this issue.

## Affected packages

- `@anthropic-ai/claude-code >= 0.2.54, < 2.1.163`

## Remediation

Upgrade to a patched release:

- `@anthropic-ai/claude-code 2.1.163`