InertFluid/cve-2026-54316-lab

PoC

Reproduction lab for CVE-2026-54316 (Claude Code WebFetch huggingface.co bare-hostname permission bypass / exfiltration)

view exploit source poc_in_githubauthor InertFluidpublished 2026-06-18catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-54316US	critical9.1	0.52% (43rd)	Exploit	2026-06-23
Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that d…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.