Skip to main content

Claude Code CVE-2026-24052

HIGH
URL Redirection to Untrusted Site (Open Redirect) (CWE-601)
2026-02-03 security-advisories@github.com GHSA-vhw5-3g5m-8ggf
Python AI / ML Claude Code Anthropic
7.4
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Register domain matching trusted prefix
  2. Exploit
    Claude Code validates using startsWith()
  3. Execution
    WebFetch automatically requests attacker domain
  4. Impact
    Exfiltrate sensitive data from response

Vulnerability Assessment

Weakness
CWE
CWE-601
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Claude Code versions prior to 1.0.111 with WebFetch feature enabled. Attacker must register domain using trusted prefix (e.g., modelcontextprotocol.io.example.com). User interaction required to trigger WebFetch request that passes flawed startsWith() validation check.
Impact

CVSS 7.4 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to automatic requests to attacker-controlled domains without user consent, potentia.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Claude Code versions prior to 1.0.111 fail to properly validate trusted domains for WebFetch requests, allowing attackers to register lookalike domains (e.g., modelcontextprotocol.io.example.com) that bypass validation checks. This enables unauthorized automated requests to attacker-controlled servers without user interaction, potentially resulting in sensitive data exfiltration from the user's environment. The vulnerability affects Claude Code's agentic coding functionality and requires upgrading to version 1.0.111 or later to remediate.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 7.4

Claude Code versions up to 1.0.111 is affected by url redirection to untrusted site (open redirect) (CVSS 7.4).

RemediationAI

Fixed in version 1.0.111.. Restrict network access to the affected service where possible.

Affected Packages

npm @anthropic-ai/claude-code fix: 1.0.111

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability (CWE-601: URL Redirection to Untrusted Site (Open Redirect)) affects Claude Code. Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains wit

Know when Claude Code gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.4 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Feb 03, 2026 - 21:16 nvd
HIGH 7.4

DescriptionGitHub Advisory

Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version 1.0.111.

Executive ViewAI

Why It Matters

Claude Code versions prior to 1.0.111 contain a URL validation flaw that could allow attackers to trick the application into making automatic requests to malicious domains they control. Organizations using Claude Code for automated coding tasks face potential data exfiltration and compromise of development workflows, particularly if the tool processes sensitive code or credentials.

Business Impact: High
Compensating Controls

Disable WebFetch feature in Claude Code if operationally feasible. Implement WAF/proxy rules to block requests to suspicious domain patterns (e.g., domains with suspicious subdomains of known legitimate domains). Apply network segmentation to restrict Claude Code's outbound connectivity to a whitelist of essential domains only. Monitor and log all outbound requests from Claude Code instances. Consider restricting Claude Code usage to non-sensitive codebases until patch is available.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

More in Claude Code

View all
CVE-2026-35022 CRITICAL POC
9.3 Apr 06

OS command injection in Anthropic Claude Code CLI and Agent SDK for Python allows remote, unauthenticated attackers to e
CVE-2025-59536 HIGH POC
8.7 Oct 03

Code injection in Anthropic's Claude Code CLI before version 1.0.111 allows malicious code embedded in a project directo
CVE-2026-35020 HIGH POC
8.6 Apr 06

OS command injection in Anthropic Claude Code CLI and Claude Agent SDK for Python allows local attackers to execute arbi
CVE-2026-35021 HIGH POC
8.4 Apr 06

OS command injection in Anthropic Claude Code CLI and Claude Agent SDK for Python enables arbitrary command execution vi
CVE-2026-39861 HIGH POC
7.7 Apr 21

Sandbox escape in Claude Code versions prior to 2.1.64 enables arbitrary file writes outside the workspace by exploiting
CVE-2026-25725 CRITICAL
10.0 Feb 06

Claude Code prior to version 2.1.2 has a CVSS 10.0 sandbox escape in the bubblewrap sandboxing mechanism, allowing code

CVE-2025-66032 CRITICAL POC
9.8 Dec 03

Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and shor
CVE-2026-25722 CRITICAL
9.1 Feb 06

Claude Code prior to version 2.0.57 failed to properly validate MCP tool inputs, allowing malicious MCP servers to injec
CVE-2026-24887 HIGH POC
8.8 Feb 03

Claude Code versions before 2.0.72 allow authenticated attackers to execute arbitrary commands by exploiting a command p
CVE-2025-64755 HIGH
8.7 Nov 21

Claude Code is an agentic coding tool. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no au
CVE-2026-55607 HIGH
7.7 Jun 29

Sandbox escape and code execution in Anthropic's Claude Code CLI (versions 2.1.38 through 2.1.162) lets a malicious repo
CVE-2025-65099 HIGH
7.7 Nov 19

Claude Code is an agentic coding tool. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no au

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all
CVE-2017-1000117 HIGH POC
8.8
CVE-2016-5385 HIGH POC
8.1
CVE-2018-11784 MEDIUM POC
4.3
CVE-2017-3528 MEDIUM POC
5.4
CVE-2012-0518 MEDIUM
4.7
CVE-2024-21641 MEDIUM POC
6.5
CVE-2015-5354 MEDIUM POC
5.8
CVE-2024-22891 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://github.com/anthropics/claude-code/security/advisories/GHSA-vhw5-3g5m-8ggf

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy