Claude Code WebFetch tool domain approval mechanism
MEDIUM
Claude Code WebFetch tool domain approval mechanism
Affected: Claude Code versions >= 0.2.54 and < 2.1.163
Fixed: 2.1.163
CVE-2026-54316 is a vulnerability in Claude Code caused by over-permissive domain matching in its WebFetch tool. Because the bare hostname huggingface.co was pre-approved without path restrictions, an attacker who injects malicious prompt content into the model’s context can force WebFetch to make HTTP requests to attacker-controlled Hugging Face repository endpoints. Because Hugging Face counts file accesses server-side, this allows attackers to establish a covert out-of-band channel to encode and exfiltrate sensitive local data (e.g., environment variables, source code, or command outputs).
Permissive Domain Approval (CWE-183): Claude Code maintained an auto-approved host list for its WebFetch integration. Broadly approving huggingface.co without scoping permissions to specific organization namespaces or subpaths allowed any arbitrary repository endpoint (e.g., /resolve/main/config.json) to bypass user confirmation prompts and --allowedTools restriction flags.
Context Injection & Prompt Steerability: If an attacker succeeds in inserting untrusted text into the model’s active context window (for instance, via a compromised repository file or pulled issue thread), the prompt instructs the agent to execute a WebFetch call targeted at a URL crafted by the attacker.
Covert Out-of-Band Storage Channel (CWE-515 / CWE-200): Instead of sending data back via direct response bodies, the exfiltration uses HTTP request metadata. The agent appends base64-encoded local secrets (such as API keys, environment parameters, or local files) into path variables or query parameters of a fetch request to a designated Hugging Face repository file. Hugging Face records these fetch requests server-side as download metrics, providing a stealthy exfiltration vector accessible to the repository owner.