Perufitlife/dotclaude-security
PoCScan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536, CVE-2026-21852) that fire when you clone+open an untrusted repository. Static, zero-dep, local-first.
01
exploited CVEs (2)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-21852US | high7.5 | Exploit | ||
Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthrop… | ||||
| CVE-2025-59536US | high8.8 | Exploit | ||
Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be trick… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan