Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

CVE-2026-54316

Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—i

历史摘要 · 未重新核验 · GitHub Advisory