CVE-2026-54316: Anthropic Claude Code: permissive WebFetch allowlist for huggingface.co enables covert data exfiltration
Claude Code versions from 0.2.54 up to, but not including, 2.1.163 pre-approved the bare hostname huggingface.co for the WebFetch tool, so any path on that domain was auto-approved, including attacker-controlled model repositories. An attacker able to inject untrusted content into a Claude Code context could use this to create a covert channel for exfiltrating data the tool can access. The record states the issue is fixed in version 2.1.163.
Overview
Claude Code, an agentic coding tool from Anthropic, pre-approved the bare hostname huggingface.co for the WebFetch tool. Because the approval covered the whole hostname rather than specific paths, any path on that domain was auto-approved without a permission prompt and without being subject to --allowedTools restrictions. The record classifies the weakness as CWE-183 (permissive list of allowed inputs).
Impact
- Data that Claude Code can access, such as files, environment variables or command output, could be sent out through server-side requests to attacker-controlled repository files on huggingface.co.
- The record describes the attack as a covert out-of-band channel, which makes it harder to detect with conventional controls.
- Reliable exploitation required the ability to add untrusted content into a Claude Code context window.
- NVD lists a CVSS 3.1 base score of 9.1 (High to Critical range, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). GitHub lists a CVSS 4.0 score of 6.
Affected products and versions
- Anthropic Claude Code, versions 0.2.54 or later and before 2.1.163.
- The description states the vulnerability is fixed in 2.1.163. The structured fixes field in the record is empty, so the fixed version is taken from the description only.
- The record does not state whether other products or components are affected.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- No confirmed exploitation in the wild appears in the sources consulted.
- No EPSS score is available in the record.
Remediation and mitigation
- Upgrade Claude Code to version 2.1.163 or later, as stated in the record.
- Until the upgrade is complete, review which hostnames are pre-approved for WebFetch and remove broad approvals where they are not needed.
- Limit the ability of untrusted content, such as external documents or web pages, to enter Claude Code contexts that have access to sensitive data.
- Review the GitHub advisory for vendor guidance: GHSA-fg94-h982-f3mm.
Detection guidance
- Review logs of outbound WebFetch activity for requests to huggingface.co that were not initiated by a user or an expected workflow.
- Look for unusual request volume or repetitive requests to model repository paths from developer or CI environments.
- Correlate such activity with sessions that processed external or untrusted content.
Limitations of the available information
- The record provides no detailed vendor description beyond the affected range and the fixed version stated in the description.
- The structured fixes field is empty, and the record gives no patch details or commit references.
- No KEV, EPSS or SSVC data is available, and the CWE name is null in the record.
- The record does not describe the integrity or availability impact of the issue.
- It is unknown whether the affected behavior exists in other Anthropic products or in other versions outside the stated range.
Frequently asked questions
Which Claude Code versions are affected by CVE-2026-54316?
According to the record, versions from 0.2.54 up to, but not including, 2.1.163 are affected. The description states the issue is fixed in 2.1.163.
Is this vulnerability known to be actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.