Noma Labs has identified a critical vulnerability in Anthropic's Claude Code Desktop application, specifically within its preview pane feature. This exploit allows for arbitrary file reading and data exfiltration by embedding malicious JavaScript in HTML files. When a user previews a file larger than 256KB, the preview pane bypasses security measures like Content Security Policy and origin isolation, enabling the execution of unrestricted JavaScript. This allows attackers to silently steal sensitive information such as API keys, credentials, and OAuth tokens. AI
IMPACT This vulnerability highlights potential security risks in AI-powered developer tools, necessitating prompt patching by Anthropic and increased vigilance from users.
RANK_REASON Security vulnerability discovered in a specific software product.
Read on HN — claude cli stories →
- .anthropic
- Chromium
- Claude Code/Desktop
- Common Vulnerability Scoring System
- Content Security Policy
- Electron
- Javascript
- Noma Labs
- WebRTC
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
