Is there a public PoC exploit available for CVE-2026-54316?

Yes, a public proof-of-concept exploit is available for CVE-2026-54316. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-54316?

Yes, a patch is available for CVE-2026-54316. Update the affected software to the latest version immediately.

Claude Code CVE-2026-54316

Q: What is the CVSS score of CVE-2026-54316?

CVE-2026-54316 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38538 MEDIUM

Permissive List of Allowed Inputs (CWE-183)

2026-06-17 https://github.com/anthropics/claude-code

GHSA-fg94-h982-f3mm

Code Injection Red Hat

6.0

CVSS 4.0 · Vendor: https://github.com/anthropics/claude-code

Severity by source

Vendor (https://github.com/anthropics/claude-code) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered prompt injection (AV:N), high complexity for context injection success (AC:H), no attacker credentials needed (PR:N), user must process injected content (UI:R), data exits to attacker-controlled server (S:C), arbitrary local data exfiltrated (C:H), no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/anthropics/claude-code).

CVSS VectorVendor: https://github.com/anthropics/claude-code

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 23, 2026 - 18:22 NVD

6.0 (MEDIUM)

Source Code Evidence Fetched

Jun 18, 2026 - 01:54 vuln.today

Analysis Generated

Jun 18, 2026 - 01:54 vuln.today

DescriptionCVE.org

Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain-including attacker-controlled model repositories-was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/novee for reporting this issue.

AnalysisAI

Out-of-band data exfiltration in Claude Code (npm/@anthropic-ai/claude-code versions 0.2.54 through 2.1.162) allows a prompt-injection attacker to silently exfiltrate files, environment variables, and command output by exploiting a pre-approved bare hostname bypass in the WebFetch tool. Because huggingface.co was whitelisted at the hostname level only, any path on that domain - including attacker-controlled model repository paths - was auto-approved without triggering a permission prompt and without being constrained by --allowedTools restrictions. The prerequisite is the ability to inject untrusted content into a Claude Code context window (e.g., via a malicious README, dependency file, or data file read during a session); no public exploit code has been identified at time of analysis, and the vulnerability has been patched in version 2.1.163.

Technical ContextAI

The affected component is the WebFetch built-in tool in Claude Code (pkg:npm/@anthropic-ai/claude-code, versions ≥ 0.2.54 and < 2.1.163), an AI-assisted coding environment. The root cause maps to CWE-183 (Permissive List of Allowed Inputs): the tool's permission model evaluated approval at the hostname granularity only, not at the full URL level. Whitelisting huggingface.co as a bare hostname implicitly pre-approved every path under that domain, including user-generated repository content (e.g., huggingface.co/attacker-user/malicious-repo/resolve/main/config.json). Because HuggingFace records server-side download metrics per URL path, an attacker can encode arbitrary data - such as file contents, environment variable values, or command output - into the URL path string, causing the Claude Code agent to issue a network request that effectively delivers the encoded payload to infrastructure the attacker monitors. This technique is a form of prompt-injection-driven covert channel, leveraging a trusted third-party domain as the exfiltration vector to bypass tooling restrictions.

RemediationAI

Vendor-released patch: 2.1.163. Users running standard Claude Code auto-update have already received the fix. Users performing manual updates should upgrade to version 2.1.163 or later immediately via npm update -g @anthropic-ai/claude-code or equivalent package manager command. The fix presumably narrows the WebFetch approval to full URL patterns rather than bare hostnames, eliminating the implicit path wildcard for huggingface.co. Until patched, users processing untrusted content (third-party repo reviews, automated pipelines with external inputs) should consider restricting Claude Code's network access via egress firewall rules or a proxy that blocks unexpected outbound requests to huggingface.co; note this may break legitimate model browsing workflows. Auditing outbound network traffic from Claude Code sessions for unexpected HuggingFace download-path requests can serve as a detection control. The advisory is at https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm.