CVE-2026-21852Disclosure(anthropic / claude_code)

CRITICALCVSS 7.5 · HIGH

Exploitation observed; activity peaked at 15 mentions and remains active

Immediate actions

Patch anthropic claude_code systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.

anthropic CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7

Weakness type (CWE)

CWE-522

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

claude_code

Threat summary

Active exploitation appears in 7 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
84 mentions across 43 observed days

What's happening

Active exploitation reported across 7 signals
Exploit tool or code specified in 4 signals
PoC mentioned or linked in 5 signals
Patch or workaround mentioned in 23 signals
Technical details provided in 63 signals
Disclosure: 35 classified signals
General: 19 classified signals
Peaked 41d ago at 15 mentions (2026-02-26); latest day: 1
84 total mentions across 43 days

Affected systems

Vendors

anthropic

Products

claude_code

Deep dive

Activity timeline84 mentions / 43d

Signal classification6 categories

Disclosure

3541.7%

General

1922.6%

Patch

1619.0%

Active Exploitation

67.1%

Exploit

44.8%

PoC

44.8%

Referenced assets25 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	2	Disclosure2
2026-02-26	15	Active Exploitation1Disclosure3Exploit3General3Patch4PoC1
2026-02-27	5	Disclosure2Patch1PoC2
2026-02-28	2	General1Patch1
2026-03-01	5	Disclosure2General3
2026-03-02	6	Disclosure4General1Patch1
2026-03-03	2	Active Exploitation1Disclosure1
2026-03-05	1	Patch1
2026-03-07	1	Exploit1
2026-03-08	1	Disclosure1
2026-03-09	1	Disclosure1
2026-03-10	1	General1
2026-03-16	5	Active Exploitation1Disclosure3General1
2026-03-17	1	General1
2026-03-19	2	Patch2
2026-03-24	1	Disclosure1
2026-03-25	1	Disclosure1
2026-03-28	1	General1
2026-03-30	1	General1
2026-03-31	2	Disclosure1General1
2026-04-02	1	Disclosure1
2026-04-03	1	Disclosure1
2026-04-05	1	General1
2026-04-06	1	Patch1
2026-04-07	2	Disclosure2
2026-04-09	1	Disclosure1
2026-04-11	1	Disclosure1
2026-04-12	1	Disclosure1
2026-04-14	1	Active Exploitation1
2026-04-16	2	Active Exploitation1General1
2026-04-17	1	Patch1
2026-04-19	1	Patch1
2026-04-26	1	Patch1
2026-04-30	1	Disclosure1
2026-05-04	1	Patch1
2026-05-07	1	Active Exploitation1
2026-05-10	4	Disclosure3General1
2026-05-11	1	Patch1
2026-06-10	1	General1
2026-06-16	1	General1
2026-06-25	1	Disclosure1
2026-07-31	1	PoC1
2026-09-24	1	Disclosure1

Full discourse20 posts

Oded Vanunu@Od3dV225d
Exploit
I hacked Claude Code! It turns out "agentic" is just a fancy new way to get a shell. I achieved full RCE and hijacked organization API keys. CVE-2025-59536 | CVE-2026-21852 https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/ #ai #Claude
Post summary
The author claims to have exploited CVE-2025-59536 and CVE-2026-21852, achieving remote code execution and API key hijacking, but no PoC or patch details are provided.
1112718591431103.4K
599 followersView on X
Hacking Space 📡@hackingspace225d
PoC
Claude Code RCE Vulnerability PoC https://github.com/atiilla/CVE-2026-21852-PoC #poc #vulnerability #Claude https://t.co/SJzNuAkNvG
Post summary
The tweet announces a Proof of Concept for a Remote Code Execution vulnerability (CVE‑2026‑21852) in Claude Code, linking to a GitHub repository.
450125012613.1K
7.1K followersView on X
Swissky@pentest_swissky181d
Disclosure
Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 - Aviv Donenfeld and Oded Vanunu https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/
Post summary
The article announces research on RCE and API token exfiltration in Claude Code project files, detailing CVE-2025-59536 and CVE-2026-21852.
08023192.4K
21.7K followersView on X
blackorbird@blackorbird225d
Disclosure
Critical vulnerabilities, CVE-2025-59536 and CVE-2026-21852, in Anthropic’s Claude Code enabled remote code execution and API key theft through malicious repository-level configuration files, triggered simply by cloning and opening an untrusted project https://blog.checkpoint.com/research/check-point-researchers-expose-critical-claude-code-flaws/ https://t.co/seoIHfG9Iu
Post summary
The blog post discloses two critical CVEs (CVE-2025-59536 and CVE-2026-21852) in Anthropic’s Claude Code that enable remote code execution and API key theft via malicious repository-level configuration files, triggered simply by cloning and opening an untrusted project.
0802592.4K
40.1K followersView on X
Cyber_OSINT@Cyber_O51NT226d
Disclosure
Check Point found CVE-2025-59536 and CVE-2026-21852 in Claude Code allow remote code execution and API key theft via untrusted repository configurations, reachable by simply cloning and opening a project. They warn that built-in hooks and env vars could … https://blog.checkpoint.com/research/check-point-researchers-expose-critical-claude-code-flaws/
Post summary
Check Point researchers identified two CVEs in Claude Code that enable remote code execution and API key theft through untrusted repository configurations, but no active exploitation or patch details are provided.
21201511.0K
21.3K followersView on X
ゲーミングPC×AI実験室｜まっすー@AIxGamingPC218d
Patch
@ml0_1337 .envは読むしCVE-2025-55284、 CVE-2026-21852、CVE-2025-59536とかで .envの中身送信するとかAPIキー飛ぶとかあったけど自分の知ってる限りバージョン更新で修正があったはずなんです。 “あえて”古いバージョンを使ってたか、これ以外の未知の脆弱性か自分的にはここが一番気になりますね！
Post summary
The tweet lists several CVEs that could leak .env data and API keys, notes that they were supposedly fixed with a version update, and expresses concern about using older versions or unknown vulnerabilities.
0501625.7K
12 followersView on X
Total Cyber-Sec@totalcybersec213d
General
#Cybernews 🚨💻 Las #Vulnerabilidades ⚠️, registradas como CVE-2025-59536 🆔 y CVE-2026-21852 🆔, podían activarse simplemente al #Clonar 🔁 y abrir 📂 un proyecto no confiable 🚫, sin necesidad de ejecutar código explícito 🧩 ni realizar acciones adicionales. https://t.co/C4zqm9ukAG
Post summary
The tweet reports that CVE-2025-59536 and CVE-2026-21852 can be activated by cloning and opening a project, but provides no evidence of an active exploit, PoC, patch, or false‑positive status.
12060301
15.9K followersView on X
Nicolas Krassas@Dinosn226d
Disclosure
Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/
Post summary
The article announces CVE-2025-59536 and CVE-2026-21852, which enable remote code execution and API token exfiltration via Claude code project files.
020241.5K
151.6K followersView on X
Sanjeev Kumar@mishrak_sanjeev195d
General
4 Agent Security Breaches That Should Change How You Think About API Keys Shai-Hulud, SANDWORM_MODE, OpenClaw, and CVE-2026-21852 — the 2025-2026 incidents that proved AI agents need their own authorization layer, not shared secrets. https://docs.grantex.dev/blog/agent-security-breaches-2025-2026
Post summary
The article cites AI agent security incidents, including CVE-2026-21852, to highlight authorization best practices, but offers no detailed vulnerability information, PoC, exploit code, or patch guidance.
00052169
544 followersView on X
Permission Protocol@PermissionPrtcl206d
General
Recent #ClaudeCode vulnerabilities (CVE-2025-59536, CVE-2026-21852) show why the AI supply chain begins with the automation layer. Configuration files like .claude/settings.json are now part of the execution layer. Authority must be deterministic. 🛡️🦾 https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html
Post summary
The tweet references two new CVE IDs for ClaudeCode but provides no technical details, proof‑of‑concept, exploitation evidence, or mitigation steps, only pointing to an external article for additional information.
10050152
35 followersView on X
GoPlus中文社区@GoPlusZH224d
Disclosure
⚠️Check Point Research（CPR）发布报告详细揭示 #Claude Code 存在通过项目文件实现远程代码执行和 API 令牌窃取等多个严重漏洞（CVE-2025-59536 和相关 CVE-2026-21852）。该漏洞并非源于传统的代码注入，而是由于 Claude Code 在处理项目级配置文件时，其自动化功能与安全信任机制之间的逻辑缺陷： 1、Hooks（钩子）功能滥用：Claude Code 支持“Hooks”功能，攻击者在仓库的 .claude/settings.json 文件中定义恶意 Hook 命令。当用户在该目录下运行 claude 命令时，这些脚本会在后台自动启动。 2、信任机制绕过（Execution Before Trust）：恶意配置定义的命令执行时间点早于信任提示的出现。这意味着即使你在看到提示后选择了“不信任”并退出，恶意代码可能已经执行完毕（例如弹出了计算器或发送了数据）。 3、MCP劫持：Claude Code 使用 MCP 与外部工具交互。攻击者通过伪造 .mcp.json 配置文件，可以静默地将原本安全的本地工具替换为恶意可执行文件。 4、API 令牌脱出（Exfiltration via Base URL）：当 Claude Code 进行身份验证时，它会将用户的 Authorization 请求头（包含 Anthropic API Key）发送到攻击者的服务器。整个过程发生在用户确认信任该目录之前。 🛡️目前 #Anthropic 已经修复了上述漏洞，开发者需升级到版本在 1.0.111 以上，避免此漏洞；另外，避免在不可信的第三方仓库或不明来源的目录下运行 claude 等 AI 命令行工具。
Post summary
Check Point Research discloses that Claude Code’s Hooks functionality allows remote code execution and API key theft, and Anthropic has patched the flaw by requiring users to upgrade to version 1.0.111 or newer.
01032745
6.4K followersView on X
Argus⚒️@ArgusForge222d
General
Running a 5-bot Claude Code swarm on political data. Built the same progressive disclosure pattern independently for auto-capturing human corrections and prepending them to agent prompts. Context rot solved with a 150-line cap and 30-day expiry. Also caught CVE-2025-59536 and CVE-2026-21852 in our deployment within 48 hours. Scaffold security is the real frontier. Great post. Validates a lot of hard-won lessons!
Post summary
The post notes detection of two CVEs in a deployment but provides no further details on exploitation, patches, or technical specifics.
00040185
3.4K followersView on X
AI駆動開発ラボ@aidriven1234167d
Patch
悪意あるリポジトリをクローンするだけでRCEとAPIキー窃取が起きるClaude Code脆弱性（CVE-2025-59536/CVE-2026-21852）が発見・修正済み。根本原因は.claude/settings.jsonがリポジトリ内に存在すること。信頼できないリポジトリを開く前にこのファイルを必ず確認する運用が必要。 #AIコーディング
Post summary
The text reports that a malicious repository clone triggers RCE and API key theft (CVE‑2025‑59536/CVE‑2026‑21852), the issue has been fixed, and users should verify the existence of .claude/settings.json before cloning untrusted repos.
10020723
53 followersView on X
ゆるくさ@yurukusa_dev174d
Patch
CVE-2026-21852: cloneしただけでAPIキーが盗まれる脆弱性がClaude Codeで見つかった。防御: user-level settings.jsonにPreToolUseフックを設定。詳細→ https://yurukusa.github.io/cc-safe-setup/opus-47-survival-guide.html
Post summary
The post identifies a new CVE where cloning Claude Code leaks API keys and offers a specific mitigation via a PreToolUse hook, with no mention of exploitation or PoC.
02010135
43 followersView on X
Carniatto | AI Engineering Labs@c4rniatto216d
Exploit
Day 11/90: The "Hello World" that stole API keys. 💀 I’ve spent 20 years telling juniors: "Don't run code you don't trust." In 2026, that's not enough. The CVE-2026-21852 exploit proved that simply opening a malicious repo with Claude Code could exfiltrate your API key before the "Trust" prompt even appeared. By overriding the ANTHROPIC_BASE_URL in a hidden settings file, attackers could capture credentials in milliseconds.
Post summary
The post illustrates how CVE-2026-21852 can be exploited via a hidden settings file override to exfiltrate API keys, but no active exploitation or patch information is provided, nor is a PoC or code disclosed.
1002099
459 followersView on X
Henry Raúl Glez Brito@henryraul222d
Disclosure
3/ Las vulnerabilidades (CVE-2025-59536 y CVE-2026-21852) permiten que un atacante manipule la interacción entre el modelo y el entorno de ejecución, logrando que el sistema ejecute comandos arbitrarios o exponga credenciales almacenadas #Ciberseguridad #DevSecOps @_CPResearch_
Post summary
The post discloses that CVE‑2025‑59536 and CVE‑2026‑21852 enable attackers to manipulate the model‑execution environment, leading to arbitrary command execution or credential exposure.
10011159
11.3K followersView on X
おぬ@中卒中年エンジニア@onumaro92225d
Patch
⚠️Check PointがClaude Codeの重大脆弱性を公開 The Hacker Newsでも報道されました内容はかなり深刻で・悪意あるリポジトリを開くだけ・RCE（Remote Code Execution＝外部から任意コード実行）可能・APIキー盗難の恐れ対象CVE CVE-2025-59536 CVE-2026-21852 すでに修正済みですが古いバージョン利用者は危険です 🛡 対策方法「実際の設定手順まで」 ① Claude Codeを最新版にするまず現在のバージョン確認 claude --version --versionはインストール済みソフトのバージョン確認オプションです v1.0.111未満 v2.0.65未満ならアップデート必須 ■ Homebrew管理の場合（mac） brew update brew upgrade claude brew update → パッケージ情報を最新化 brew upgrade claude → Claudeを最新版へ更新 ■ npm管理の場合 npm update -g @anthropic-ai/claude-code -gはグローバルインストールの意味更新後もう一度 claude --version で確認してください ② APIキーのローテーション（再発行）旧バージョンを使っていた可能性があるなら必須です手順 1. Anthropicダッシュボードへログイン 2. API Keys画面へ 3. 既存キーを削除 4. 新しいキーを発行 5. .envを書き換え .envとは環境変数を定義する設定ファイル APIキーなどの秘密情報を保存する場所です例 ANTHROPIC_API_KEY=新しいキー ③ .claude設定ファイルを確認する今回の攻撃は .claude/settings.jsonなどの設定悪用が起点でしたまず存在確認 ls -la .claude lsはファイル一覧表示コマンド -laは隠しファイル含めて詳細表示中身確認 cat .claude/settings.json catはファイル内容を表示するコマンド不審な外部URLや自動実行hookがあれば削除してください ④ 未検証リポジトリを安全に確認する手順いきなりClaudeで開かないこと git clone <repo> cd <repo> ls -la 以下を目視確認・.claude ・.mcp ・自動実行スクリプト・怪しい外部URL設定問題ないことを確認してから開きます ⑤ APIキーの最小権限化原則は「最小権限の原則」・本番用と開発用キーを分ける・不要な権限は付与しない・定期的にキーをローテーションする 📌 まとめ Claude Codeは便利な開発ツールですが同時に「コードを実行できる環境」でもありますつまり攻撃対象になります ✔ 最新版へ更新 ✔ APIキー再発行 ✔ .claude設定確認 ✔ 未検証リポジトリは開かないここまでやって初めて対策完了です
Post summary
The post announces that CVE-2025-59536 and CVE-2026-21852 are actively exploited and provides comprehensive patching and mitigation instructions for users of Claude Code.
10020245
385 followersView on X
Claudecode_JP　Engineer⚙@Claudecode_JPEE152d
Disclosure
Claude Code Security Vulnerabilities: CVE-2025-59536 & CVE-2026-21852 Analysis Critical vulnerabilities in Claude Code enable remote code execution and API key theft via malicious repository configurations. Analysis of three developer ... Written from an engineering perspective.
Post summary
The post outlines two critical CVEs in Claude Code, detailing how malicious repository configurations enable remote code execution and API key theft, but it does not report active exploitation or offer patches.
20000852
9 followersView on X
ササハラケンイチ　answer thee web代表@answer_thee_web186d
Patch
「AIに任せれば自分が何も分からなくても大丈夫」この誤解、今一番広がってる気がする。 😅 ローカルで動かすリスクの話、実際に今年2月に悪意ある設定ファイルをリポジトリに含めるだけで APIキーが外部送信される脆弱性（CVE-2026-21852）が報告されてる。現在は修正済みだけど、「開く行為自体が攻撃面になる」という構図は設定層が実行機能を持つAIツール特有の話で、従来の感覚とはズレがある。 Codespaces等の隔離環境を推奨しているのはまさにここを理解した上での話で、「とりあえず動いた」で終わらせない姿勢がそのまま品質に出る。ツールの進化より先にリスクの理解が来る、という話は Web制作の現場でもずっと同じだったりする。 🙏
Post summary
The post notes that CVE‑2026‑21852, which allows malicious config files to leak API keys, has already been patched, without mentioning any PoC, exploit code, or active exploitation.
0002066
108 followersView on X
francescofaenzi@francescofaenzi194d
General
1️⃣ About Claude Code vulnerabilities (CVE-2025-59536, CVE-2026-21852) : the attack surface no longer exists at the code execution layer alone. It has migrated upward into the configuration and initialization layers that govern how AI assistants interact with infrastructure before a developer issues a single command. The Claude Code vulnerabilities demonstrate that AI-augmented development environments collapse traditional security boundaries. Configuration files execute code. API keys leak during initialization. Documentation poisons code generation. Countermeasures require treating AI assistants as untrusted external services, not as extensions of the developer. Every file in a repository that influences AI behavior must be validated. Every AI-generated output must be verified before integration. The supply chain attack surface now includes not just what code is written, but how the tools that assist in writing code are configured and what context they consume. Detailed analysis follows. ## Breakthrough 1: Configuration-as-Code Becomes Configuration-as-Execution ## Breakthrough 2: Zero-Interaction API Key Exfiltration via Endpoint Redirection ## Breakthrough 3: Persistent Infrastructure Compromise via AI-Generated Code Injection
Post summary
The text outlines new CVEs related to AI development environments, highlighting how the attack surface has shifted to configuration and initialization layers, provides mitigation guidance, but does not present PoC or active exploitation evidence.
10100217
662 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	anthropic	claude_code	-	node.js	-

Explore more

Back to dashboard anthropic CVEs claude_code vulnerabilities

What researchers are saying

CVE-2026-21852

Swissky[verified]@pentest_swisskyDisclosure

The article announces research on RCE and API token exfiltration in Claude Code project files, detailing CVE-2025-59536 and CVE-2026-21852.

blackorbird[verified]@blackorbirdDisclosure

The blog post discloses two critical CVEs (CVE-2025-59536 and CVE-2026-21852) in Anthropic’s Claude Code that enable remote code execution and API key theft via malicious repository-level configuration files, triggered simply by cloning and opening an untrusted project.

ゲーミングPC×AI実験室｜まっすー[verified]@AIxGamingPCPatch

The tweet lists several CVEs that could leak .env data and API keys, notes that they were supposedly fixed with a version update, and expresses concern about using older versions or unknown vulnerabilities.

Nicolas Krassas[verified]@DinosnDisclosure

The article announces CVE-2025-59536 and CVE-2026-21852, which enable remote code execution and API token exfiltration via Claude code project files.

Sanjeev Kumar[verified]@mishrak_sanjeevGeneral

The article cites AI agent security incidents, including CVE-2026-21852, to highlight authorization best practices, but offers no detailed vulnerability information, PoC, exploit code, or patch guidance.

GoPlus中文社区[verified]@GoPlusZHDisclosure

Check Point Research discloses that Claude Code’s Hooks functionality allows remote code execution and API key theft, and Anthropic has patched the flaw by requiring users to upgrade to version 1.0.111 or newer.

Argus⚒️[verified]@ArgusForgeGeneral

The post notes detection of two CVEs in a deployment but provides no further details on exploitation, patches, or technical specifics.

Carniatto | AI Engineering Labs[verified]@c4rniattoExploit

The post illustrates how CVE-2026-21852 can be exploited via a hidden settings file override to exfiltrate API keys, but no active exploitation or patch information is provided, nor is a PoC or code disclosed.