CVE-2026-54316

Name of the Vulnerable Software and Affected Versions Claude Code versions 0.2.54 through 2.1.162

Description Claude Code, an agentic coding tool, contains an issue where the hostname huggingface.co was pre-approved for the WebFetch tool. This allowed any path on that domain, including attacker-controlled model repositories, to be auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker capable of injecting untrusted content into the tool's context window could direct it to issue WebFetch requests to attacker-controlled repository files, such as /resolve/main/config.json. Because HuggingFace tracks these requests as downloads server-side, it creates a covert out-of-band channel to exfiltrate sensitive data accessible to the tool, including files, environment variables, or command output. This could potentially lead to remote code execution (RCE).

Recommendations Update Claude Code to version 2.1.163 or later.