A high-severity (CVSS 8.7) Claude Code security vulnerability could enable attackers to exfiltrate files from the local machine and execute malicious code locally.
Dubbed SneakPeek, the vulnerability affects the Claude Code Desktop preview pane, which allows developers to automatically view or render edited or generated HTML files using Electron’s Chromium-based rendering engine.
While the preview pane employs several measures to prevent malicious content from executing, researchers at Noma Security discovered numerous ways attackers could bypass the security controls.
The vulnerabilities stemmed from Claude Code Desktop preview pane’s inability to consistently apply the three security policies. The security vulnerabilities include a missing content security policy, unrestricted origin access, and inactive request filtering.
When chained, the three security flaws could enable an attacker to read arbitrary files, execute local commands, and exfiltrate data.
Claude Code security vulnerability explained
According to Noma Security researchers, the Claude Code preview pane runs in a sandbox that employs numerous security measures. These include a Content Security Policy (CSP) that prevents JavaScript execution and a URL loading policy that prevents fetching local files.
However, the content security policy works differently for files smaller or larger than 256 KB. For a file under 256 KB, the preview pane renders it using data: URLs that block access to local files.
When the file exceeds 256 KB, the preview pane loads it using file: URLs through which the Chromium renderer runs unrestricted and can read local files via the JavaScript ‘fetch()’ function.
An attacker could trigger the Claude Code security vulnerability by deploying a public code repository and embedding an HTML file exceeding 256KB that includes a malicious script. When the developer reviews or edits the file, the malicious file automatically executes and exfiltrated data.
When exploited, the Claude Code security vulnerability could enable attackers to exfiltrate SSH private keys, AWS keys and secrets, npm and GitHub auth tokens, Kubernetes credentials, Docker registry auth, and Git identity and tokens without user interaction or prompt.
“This exfiltration method works because, as mentioned previously, Claude Code Desktop is an Electron app. Electron apps’ entire UI runs on a full Chromium browser engine with access to all standard web APIs.”
According to Ronald Lewis, Head of Cybersecurity Governance at Black Duck, emerging technologies are reshaping the attack surface.
“Attackers are increasingly targeting the AI ecosystem, exploiting implicit trust relationships between models, agents, tools, data sources, and connected services,” said Lewis. “As AI ecosystems become more interconnected, the attack surface expands beyond traditional applications and infrastructure. We’ve spent years dealing with attacks that exploit trust relationships, privilege boundaries, and interconnected systems.”
“As organizations become more reliant on AI augmentation, people become less inclined to challenge outputs and more willing to accept recommendations at face value. Attackers are increasingly targeting those areas of implicit trust because they often represent the path of least resistance,” added Lewis.
Claude Code patches preview pane security vulnerability
Anthropic was notified of the security vulnerability on July 4, 2026, patched it on July 7 by blocking fetch() and XMLHttpRequest on `file:` paths, and delivered an auto-update on July 17.
“They triaged the initial report, scored it CVSS 8.7 (High) using CVSS v4.0, and deployed a patch blocking direct fetch() and XMLHttpRequest calls to file:// paths from the renderer,” wrote the researchers.
However, the researchers retested the vulnerability and discovered a workaround on July 24 by triggering the security flaw using a `blob:` URL and a Web Worker. According to the researchers, the security vulnerability remained unfixed for some time after the disclosure.
“After we submitted the bypass demonstrating that URL Web Workers could circumvent the fix, they confirmed the issue remained unresolved and committed to additional work to address it,” they stated.
Meanwhile, Noma Security has verified that Anthropic has fixed all vulnerabilities and closed the issue as resolved. So far, it remains unclear if threat actors had exploited the vulnerability in the wild.
