Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M

CVE-2026-24052Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

High 7.1

In plain English

A high-severity open redirect in claude-code from anthropics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version 1.0.111.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@anthropic-ai/claude-code	1.0.111	GHSA-vhw5-3g5m-8ggf

Affected products (as reported)

Vendor	Product	Versions
anthropics	claude-code	< 1.0.111

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-vhw5-3g5m-8ggf x_refsource_CONFIRM