Is CVE-2026-54316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54316 being exploited in the wild.

How severe is CVE-2026-54316?

Medium severity, with a CVSS score of 3.1, published 23 June 2026.

Which products and versions are affected?

Anthropic Claude Code >= 0.2.54, = 0.2.54, < 2.1.163, SEMVER:introduced=0.2.54,fixed=2.1.163.

Is there a fix for CVE-2026-54316?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54316 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54316?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54316: Anthropic Claude Code data exfiltration via HuggingFace allowlist bypass

Q: Is there a fix for CVE-2026-54316?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54316 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54316?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54316 · Severity: medium · CVSS 3.1 · Published 2026-06-23

Claude Code is an AI-powered coding assistant that can execute commands and fetch web data. A security flaw allowed the tool to access any page on HuggingFace without asking for user permission. An attacker could trick the AI into sending sensitive information—like your private files or environment variables—to a server they control by disguising the data transfer as a simple file download.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-54316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54316 being exploited in the wild.
How severe is CVE-2026-54316?: Medium severity, with a CVSS score of 3.1, published 23 June 2026.
Which products and versions are affected?: Anthropic Claude Code >= 0.2.54, < 2.1.163; @anthropic-ai/claude-code (npm) >= 0.2.54, < 2.1.163, SEMVER:introduced=0.2.54,fixed=2.1.163.
Is there a fix for CVE-2026-54316?: Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54316 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54316?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later
```
npm install @anthropic-ai/claude-code@2.1.163
```

Technical details

Claude Code (versions 0.2.54 to 2.1.163) pre-approved the 'huggingface.co' hostname for its WebFetch tool without path restrictions. This permissive allowlist (CWE-183) allows an attacker who can inject untrusted content into the AI's context window to force the agent to make requests to attacker-controlled HuggingFace repositories. Because HuggingFace logs these requests as downloads, an attacker can encode sensitive local data (files, environment variables, or command outputs) into the request paths, effectively creating a covert storage channel (CWE-515) for exfiltration. The vulnerability is fixed in version 2.1.163.

Affected products

Anthropic AI Claude Code >= 0.2.54, < 2.1.163

Identifiers

CVE-2026-54316
GHSA-fg94-h982-f3mm

Timeline

2026-06-13: advisory: GitHub advisory published by Anthropic AI
2026-06-23: disclosed: NVD publication date
2026-06-13: patched: Fixed in version 2.1.163

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.