CVE-2026-24052
CVE-2026-24052 · Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version 1.0.111.
CVSS 7.1 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
claude-code
- Versions du logiciel
- < 1.0.111: Concernée
Aucun correctif publié
@anthropic-ai/claude-code npm
- Plages de versions concernées
- SEMVER: < 1.0.111
Mettez à jour vers 1.0.111