Claude Code, versions 0.2.54 through 2.1.162, automatically trusts any request to huggingface.co as a pre‑approved hostname for its WebFetch tool. This means any path under that domain—including attacker‑controlled model repositories—was accepted without a permission prompt or tool restriction. An attacker who can inject the agent to fetch files from attacker‑controlled HuggingFace repositories (for example, "/resolve/main/config.json"). HuggingFace records these fetched files as downloads on the server side, creating a covert out‑of‑band channel that Claude Code can use to exfiltrate data it has access to, such as local files, environment variables, or command output. The vulnerability relies on improper handling of hostnames (CWE‑183) and leads to information disclosure (CWE‑200) and potential data leakage via unintended file transfer (CWE‑515) and improper conditional input processing (CWE‑863).

Anthropic’s Claude Code product, versions 0.2.54 up to and including 2.1.162, is affected.

The CVSS score of 6 indicates a moderate exploitation risk, and the vulnerability is not listed in KEV. The EPSS score is below 1%, indicating a very low likelihood of exploitation in the wild. The attack requires the ability to inject untrusted content into a Claude Code context, after which the tool will automatically issue WebFetch requests to any path on huggingface.co. Exploitation could allow an attacker to exfiltrate data from the host executing Claude Code, but it depends on the presence of such injection vectors.