Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
High severity. Affects @anthropic-ai/claude-code < 1.0.111. Upgrade to 1.0.111 or later.
CVE-2026-24052 / GHSA-vhw5-3g5m-8ggf · severity: high · npm
Affected
@anthropic-ai/claude-code< 1.0.111 → fixed in 1.0.111
Details
Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Thank you to hackerone.com/47sid-praetorian for reporting this issue!
Source: GHSA-vhw5-3g5m-8ggf — GitHub Advisory Database (CC-BY-4.0).