# CVE-2026-54316: Anthropic Claude Code data exfiltration via HuggingFace allowlist bypass

Source: https://junglewise.ai/threats/cve-2026-54316-anthropic-claude-code-data-exfiltration-via-huggingface-allowlist  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-54316 · Severity: medium · CVSS 3.1 · Published 2026-06-23

Claude Code is an AI-powered coding assistant that can execute commands and fetch web data. A security flaw allowed the tool to access any page on HuggingFace without asking for user permission. An attacker could trick the AI into sending sensitive information—like your private files or environment variables—to a server they control by disguising the data transfer as a simple file download.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54316 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54316 being exploited in the wild.

**How severe is CVE-2026-54316?** Medium severity, with a CVSS score of 3.1, published 23 June 2026.

**Which products and versions are affected?** Anthropic Claude Code >= 0.2.54, < 2.1.163; @anthropic-ai/claude-code (npm) >= 0.2.54, < 2.1.163, SEMVER:introduced=0.2.54,fixed=2.1.163.

**Is there a fix for CVE-2026-54316?** Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54316 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54316?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 2.1.163 or later

  ```sh
  npm install @anthropic-ai/claude-code@2.1.163
  ```


## Technical details

Claude Code (versions 0.2.54 to 2.1.163) pre-approved the 'huggingface.co' hostname for its WebFetch tool without path restrictions. This permissive allowlist (CWE-183) allows an attacker who can inject untrusted content into the AI's context window to force the agent to make requests to attacker-controlled HuggingFace repositories. Because HuggingFace logs these requests as downloads, an attacker can encode sensitive local data (files, environment variables, or command outputs) into the request paths, effectively creating a covert storage channel (CWE-515) for exfiltration. The vulnerability is fixed in version 2.1.163.

## Affected products

- Anthropic AI Claude Code >= 0.2.54, < 2.1.163

## Identifiers

- CVE-2026-54316
- GHSA-fg94-h982-f3mm

## Timeline

- 2026-06-13: advisory: GitHub advisory published by Anthropic AI
- 2026-06-23: disclosed: NVD publication date
- 2026-06-13: patched: Fixed in version 2.1.163

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm](https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)