Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2026-21852 EUVD-2026-3597GHSA-jh7p-qr78-84p7

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

Published Jan 21, 2026 · Updated Jan 21, 2026 · Assigned by GitHub_M

Vendor: anthropics Product: claude-code Package: @anthropic-ai/claude-code Ecosystem: npm

Description

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.

Affected products

VendorProductAffectedFixed
anthropics claude-code < 2.0.65 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • atiilla/CVE-2026-21852-PoC ★ 24 · Feb 27, 2026
  • abhishek2512mishra/claude-code-security-audit ★ 0 · Sep 13, 2026

    Security scanner auditing Claude Code environments for CVE-2026-21852 pre-trust execution, hook hijacking, and eBPF lockdown.

  • Perufitlife/dotclaude-security ★ 0 · Jun 21, 2026

    Scan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untr…

  • TreRB/ai-ide-config-guard ★ 0 · Apr 20, 2026

    Scan a repo for AI-IDE config files that can trigger RCE via Claude Code hooks, Cursor rules, MCP auto-registration. Detects CVE-2025-59536, CVE-2026-21852, CVE-2026-30615 + Pillar Rules File Backdoo…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @anthropic-ai/claude-code < 2.0.65 2.0.65 GHSA-jh7p-qr78-84p7

References