AI agent vulnerability · Claude Code

CVE-2026-24052: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

highCVSS 4.0 7.1GHSA-vhw5-3g5m-8ggf

Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation.

Published Feb 3, 2026

Affected packages

@anthropic-ai/claude-code

Ecosystem: npm
Affected: < 1.0.111
Fixed in: 1.0.111
Check: npm ls @anthropic-ai/claude-code

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/47sid-praetorian for reporting this issue!

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Claude Code vulnerabilities

All Claude Code entries