github.comadvisoryCVE-2026-21852 - GitHub Advisory Database
GitHub advisory GHSA-jh7p-qr78-84p7 for Claude Code: a malicious repository could ship a project settings file setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint. Claude Code made API requests during project load before the trust prompt was shown, leaking data including the user's Anthropic API key. Fixed in auto-updated versions; manual updaters should upgrade. It is CVSS v4 scored, with network attack vector and passive user interaction, and mapped to a credential-transmission weakness (insecure transmission/storage of credentials).
TL;DR Claude Code sent API requests (leaking API keys) to an attacker's ANTHROPIC_BASE_URL from a repo settings file before the trust prompt appeared.
Organisations named here
- GHSA-jh7p-qr78-84p7
- workspace trust prompt bypass
Technologies named here
- Claude Code
- Anthropic
- CVSS
- GitHub
Also named here
- ANTHROPIC_BASE_URL
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle