A security vulnerability, tracked as CVE-2026-21852, has been identified in Claude Code versions prior to 2.0.65. The flaw allowed malicious repositories to exfiltrate API keys by setting a specific configuration value before the user was prompted to confirm trust in the repository. This means simply opening a compromised folder could lead to an API key being sent to an attacker-controlled server without any further user interaction. The issue has been fixed in version 2.0.65 and later. AI
IMPACT Exposes a critical security flaw in AI coding assistants, highlighting the need for robust trust mechanisms before executing user-provided code configurations.
RANK_REASON Disclosure of a security vulnerability and its fix in a specific software tool.
Read on dev.to — Claude Code tag →
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
