Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 2.1.163.

The version of Anthropic Claude Code installed on the remote host is 0.2.54 prior to 2.1.163. It is, therefore, affected by a data exfiltration vulnerability.

  - Because the hostname huggingface.co was pre-approved as a bare       hostname for the WebFetch tool, any path on that domain including       attacker-controlled model repositories was auto-approved without a       permission prompt or being subject to --allowedTools restrictions.
      An attacker able to inject untrusted content into a Claude Code       context could direct it to issue WebFetch requests against       attacker-controlled repository files, which HuggingFace counts as       downloads server-side, creating a covert out-of-band channel for       encoding and exfiltrating data Claude can access such as files,       environment variables, or command output. Reliably exploiting this       required the ability to add untrusted content into a Claude Code       context window. (CVE-2026-54316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was
    pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-
    controlled model repositories—was auto-approved without a permission prompt or being subject to
    --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could
    direct it to issue WebFetch requests against attacker-controlled repository files (e.g.
    /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-
    band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or
    command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code
    context window. This vulnerability is fixed in 2.1.163. (CVE-2026-54316)

ID	Name	Product	Family	Type	Severity
322792	Anthropic Claude Code 0.2.54 < 2.1.163 Data Exfiltration (CVE-2026-54316)	Nessus	Misc.	Local	medium
443352	SCA: security update for @anthropic-ai/claude-code (GHSA-fg94-h982-f3mm)	Tenable Cloud Security	SCA Checks	Local	medium
443352	SCA: security update for @anthropic-ai/claude-code (GHSA-fg94-h982-f3mm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54316

medium

Tenable Plugins

medium

medium

medium