CVE-2026-21852 in the critical feed json
Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation
published 2026-01-21 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-3597 , GHSA-jh7p-qr78-84p7
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 27.5%
- EPSS 27.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.
Patch / fix
- npm @anthropic-ai/claude-code 2.0.65
- anthropic claude_code 2.0.65
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
27.50% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @anthropic-ai/claude-code | <2.0.65 |
2.0.65 |
Affected products
- anthropics claude-code
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-21852
advisory
-
github.com
/anthropics/claude-code
package
Sources
- CVE List CVE-2026-21852
- GitHub Advisory GHSA-jh7p-qr78-84p7
- NVD CVE-2026-21852
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.