{"id":"EUVD-2026-38538","enisaUuid":"35cbb3d2-f2d2-3bee-a740-51f9456c36e9","description":"Claude Code is an agentic coding tool.  From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 2.1.163.","datePublished":"Jun 23, 2026, 5:06:16 PM","dateUpdated":"Jun 23, 2026, 5:37:38 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm\n","aliases":"CVE-2026-54316\nGHSA-fg94-h982-f3mm\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"4202a128-ef65-35d8-b1eb-93beb327ae18","product":{"name":"claude-code","vendor":{"name":"anthropics"}},"product_version":"0.2.54, \u003c 2.1.163"}],"enisaIdVendor":[{"id":"e263d6ed-a116-3415-bde3-44512e4ddefd","vendor":{"name":"anthropics"}}],"enisaIdVulnerability":[{"id":"53634337-b661-3787-b9f4-1a24a088a149","vulnerability":{"id":"CVE-2026-54316","description":"Claude Code is an agentic coding tool.  From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 2.1.163.","datePublished":"Jun 23, 2026, 5:06:16 PM","dateUpdated":"Jun 23, 2026, 5:37:38 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm\n","enisa_id":"EUVD-2026-38538\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"2d0f0975-c786-300e-aa6f-26d2c50217f9","product":{"name":"claude-code","vendor":{"name":"anthropics"}},"product_version":"0.2.54, \u003c 2.1.163"}],"vulnerabilityVendor":[{"id":"633b7a67-5fe2-3127-b43d-7a940ae85c83","vendor":{"name":"anthropics"}}]}},{"id":"ddfe5bd5-b4d2-3f34-8643-39455eb9de77","vulnerability":{"id":"GHSA-fg94-h982-f3mm","description":"Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch","datePublished":"Jun 17, 2026, 6:06:06 PM","dateUpdated":"Jul 20, 2026, 9:10:30 PM","baseScore":0.0,"references":"https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54316\nhttps://github.com/anthropics/claude-code\n","enisa_id":"EUVD-2026-38538\n","aliases":"CVE-2026-54316\nGHSA-fg94-h982-f3mm\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}