Claude Code, prior to version 1.0.111, relied on startsWith() logic to validate trusted domains for WebFetch requests. This allowed attackers to register domains that prefixed a legitimate domain (e.g. modelcontextprotocol.io.example.com), causing the tool to treat them as trusted and automatically send WebFetch requests to them without user consent. Such automatic outbound calls could lead to data exfiltration or malicious payload delivery, representing a significant confidentiality risk.

Anthropic’s Claude Code product, versions earlier than 1.0.111, are affected. The vulnerability exists in all binaries that perform WebFetch requests before the patched version.

The flaw carries a CVSS Score of 7.1, categorizing it as high impact, yet the EPSS score is below 1 %, indicating a low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to trigger a WebFetch request from within the tool, so ordinary users are not directly exposed, but an attacker who can manipulate the tool or its inputs can force automatic traffic to attacker‑controlled domains. Given the potential for data leakage, the risk remains significant despite the low exploitation probability.