Claude Code CVE-2026-54316

Exploitation requires two concrete conditions: (1) the attacker must be able to inject untrusted instruction content into the Claude Code context window - for example, by embedding a prompt-injection payload in a file that Claude is asked to read (README, config file, dependency manifest, data file) within a repository or directory being processed; and (2) the target system running Claude Code must have outbound network access to huggingface.co on port 443. The pre-approved domain bypass removes the normal permission-prompt safeguard and the --allowedTools restriction as additional limiting factors that would otherwise require explicit user approval. Exploitation is limited by: the attacker's ability to get content into the context window (requires some form of social engineering, supply chain placement, or prior compromise of a file the user processes); the need for outbound HTTPS access to huggingface.co not being blocked by egress controls; and the exfiltrated data being limited to what the Claude Code process can access within the session (files, env vars, command output - not OS-level privilege escalation). Authentication to Claude Code or the host system is not required by the attacker.

Real-world risk is elevated for users of Claude Code who routinely process untrusted content (reviewing third-party repositories, reading user-supplied configuration files, or operating in automated pipelines with external inputs). The core exploitation barrier is the ability to inject instructions into the context window - a well-documented class of attack against LLM-based coding agents. CVSS is not provided by the vendor, but the attack vector is network-reachable (injected content delivered remotely), complexity is high (content injection must succeed and be framed correctly to trigger the fetch), and the confidentiality impact is high (arbitrary local data accessible to the Claude Code process can be exfiltrated). No EPSS score is available as NVD has not yet assigned one; KEV status is negative. The --allowedTools bypass dimension is particularly significant for organizations that believed tool restrictions provided a security boundary - this vulnerability breaks that assumption for the HuggingFace domain specifically. The covert nature of the channel (disguised as a legitimate model download) makes detection difficult without network egress monitoring. The patch is available and auto-update users are already protected.

A threat actor publishes a malicious HuggingFace repository and embeds a prompt-injection payload inside a README.md or model config file within a target GitHub repository. When a developer uses Claude Code to review or summarize that repository, Claude reads the README and encounters instructions to fetch a HuggingFace URL constructed from encoded environment variables or SSH key contents. Because huggingface.co is pre-approved, Claude issues the WebFetch request silently, and the attacker's server-side download logs capture the exfiltrated data encoded in the request path. No public proof-of-concept code has been identified, but the technique is straightforward for any attacker with a HuggingFace account and the ability to place a file in the developer's review scope.