Read the docs
TI-2026-19380 Aliases CVE-2026-24052GHSA-vhw5-3g5m-8ggf

Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

Priority LOW 32CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version 1.0.111.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed claude-code (anthropics): 1.0.111@anthropic-ai/claude-code (npm): 1.0.111

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
anthropicsclaude-codebefore 1.0.1111.0.111Patch availableCNA
—@anthropic-ai/claude-code (npm)before 1.0.1111.0.111Patch availableGHSA-vhw5-3g5m-8ggf
  • claude-code Vendoranthropics Affected before 1.0.111 Fixed in 1.0.111 Patch available CNA
  • @anthropic-ai/claude-code (npm) Vendor— Affected before 1.0.111 Fixed in 1.0.111 Patch available GHSA-vhw5-3g5m-8ggf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*before 1.0.111Vulnerableanthropics
  • cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:* Versions before 1.0.111 Vulnerable ·anthropics

Remediation

  • Fix · CNA claude-code (anthropics) Fixed in 1.0.111
  • Fix · GHSA-vhw5-3g5m-8ggf @anthropic-ai/claude-code (npm) Fixed in 1.0.111 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24052
  2. 2026-10-03 Alias added: GHSA-vhw5-3g5m-8ggf

References

Advisory 2

Other 1

  • TI-2025-40558 Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVSS 4.0HIGH 8.7
  • TI-2025-36683 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVSS 4.0HIGH 8.7
  • TI-2025-37066 Claude Code's startup trust dialog could lead to Command Execution attack CVSS 4.0HIGH 8.7
  • TI-2026-17554 Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation CVSS 4.0MEDIUM 5.3
  • TI-2025-40093 @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes CVSS 4.0HIGH 8.7
  • TI-2025-36422 Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution CVSS 4.0HIGH 8.7
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences