Claude Code, versions 0.2.54 through 2.1.162, automatically trusts any request to huggingface.co as a pre‑approved hostname for its WebFetch tool. This means any path under that domain—including attacker‑controlled model repositories—was accepted without a permission prompt or tool restriction. An attacker who can inject untrusted content into a Claude Code context can instruct the agent to fetch files from attacker‑controlled HuggingFace repositories (for example, "/resolve/main/config.json"). HuggingFace records these fetched files as downloads on the server side, creating a covert out‑of‑band channel that Claude Code can use to exfiltrate data it has access to, such as local files, environment variables, or command output. The vulnerability relies on improper handling of hostnames (CWE‑183) and leads to information disclosure (CWE‑200) and potential data leakage via unintended file transfer (CWE‑515). Reliable exploitation requires a vector for injecting malicious content into a Claude Code session. The vulnerability is fixed in version 2.1.163.

Anthropic’s Claude Code product, versions 0.2.54 up to and including 2.1.162, is affected.

The CVSS score of 6 indicates a moderate severity, while no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to inject untrusted content into a Claude Code context, after which the tool will automatically issue WebFetch requests to any path on huggingface.co. Exploitation could allow an attacker to exfiltrate data from the host executing Claude Code, but it is dependent on the presence of such injection vectors.