{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-54316",
    "name": "CVE-2026-54316",
    "vendor": "Claude Code",
    "description": "Claude Code shipped huggingface.co as a bare pre-approved hostname for the WebFetch tool, so every path on that domain, including attacker-controlled model repositories, was fetched with no permission prompt and outside any --allowedTools restriction. Novee Security used the public download counter on those repositories as a covert channel, leaking an API key one character at a time out of any session that had untrusted content in context. Present in every release from 0.2.54 to 2.1.162 and fixed in 2.1.163; Anthropic scores it 6.0 under CVSS v4 while the NVD v3.1 vector puts it at 9.1.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-54316",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-07",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-54316",
      "aliases": [
        "ti-072"
      ],
      "title": "CVE-2026-54316: Claude Code Pre-Approved huggingface.co, Turning a Download Counter Into an Exfiltration Channel",
      "summary": "Claude Code shipped huggingface.co as a bare pre-approved hostname for the WebFetch tool, so every path on that domain, including attacker-controlled model repositories, was fetched with no permission prompt and outside any --allowedTools restriction. Novee Security used the public download counter on those repositories as a covert channel, leaking an API key one character at a time out of any session that had untrusted content in context. Present in every release from 0.2.54 to 2.1.162 and fixed in 2.1.163; Anthropic scores it 6.0 under CVSS v4 while the NVD v3.1 vector puts it at 9.1.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Data exfiltration"
      ],
      "componentType": "agent",
      "component": {
        "name": "Claude Code",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Claude Code 0.2.54 to 2.1.162",
          "fixed": "2.1.163"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-07",
      "modifiedAt": "2026-08-07",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54316"
        }
      ],
      "mitigation": "Upgrade Claude Code to 2.1.163 or later and enforce it as a fleet minimum. Rotate Anthropic API keys used on machines that ran untrusted repositories before the patch. Then audit your own allowlists for bare hostnames: approving a domain approves every path on it, including pages any member of the public can upload.",
      "detectedByAnomity": true
    }
  }
}