Skip to content
OpenAdvisories

Weakness (CWE)

CWE-183: Permissive List of Allowed Inputs

Base Draft

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Source: MITRE CWE-183

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.0
    CVE-2026-54316 Public exploit

    Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

    Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without…

    anthropics claude-code @anthropic-ai/claude-code npm