PulseAugur
中
实时 11:38:08
English(EN) Claude Code Desktop Vulnerability: Preview Pane Data Exfiltration

Claude Code Desktop 漏洞允许通过预览窗格进行数据泄露

作者 PulseAugur 编辑部 · [3 个来源] ·

Noma Labs 发现 Anthropic 的 Claude Code Desktop 应用程序存在一个关键漏洞，代号为 SneakPeek。该漏洞允许恶意 HTML 文件伪装成代码覆盖率报告，并超过 256KB，从而绕过三层沙箱隔离。这使得在无需用户交互或警告的情况下，能够任意读取和泄露用户本地机器上的敏感数据，如 SSH 密钥、AWS 凭证和 API 令牌。Anthropic 将此漏洞的 CVSS 评分定为 8.7，并已发布修复程序，尽管最初的补丁在实施更强大的架构解决方案之前被绕过。 AI

影响 此漏洞凸显了 AI 驱动的开发工具所带来的安全风险，以及对强大沙箱隔离和及时修补的需求。

排序理由 发现特定软件产品的安全漏洞。

在 HN — claude cli stories 阅读 →

AI 生成摘要 · Google Gemini · 来自 3 个来源。 我们如何撰写摘要 →

Claude Code Desktop 漏洞允许通过预览窗格进行数据泄露

本文如何被排名

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
发现特定软件产品的安全漏洞。
Source corroboration
3 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
14 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.
Coverage growth since scoring
+1 source(s) since last score
New sources have picked up this story since our last re-score. Score will update on the next scoring pass.

完整方法见我们的编辑标准。

报道来源 [3]

  1. HN — claude cli stories TIER_1 English(EN) · wondersky ·

    Claude 代码桌面漏洞：预览窗格数据泄露

  2. dev.to — Anthropic tag TIER_1 English(EN) · Rohit Bhadani ·

    Anthropic Claude 代码桌面漏洞，成功绕过三层沙盒防护

    <p>On October 14, 2026, Noma Security disclosed a Claude Code Desktop vulnerability called SneakPeek that let a malicious HTML file read SSH keys, AWS credentials, and GitHub tokens from a developer's machine with no click and no warning. Anthropic rated it CVSS 8.7 and shipped t…

  3. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    Claude Code Desktop 的预览窗格可能让恶意 HTML 窃取 SSH 密钥、云凭证、GitHub 和 npm 令牌。Anthropic 在初步修补后进行了修复

    Claude Code Desktop’s preview pane could let malicious HTML steal SSH keys, cloud credentials, GitHub and npm tokens. Anthropic fixed it after an initial patch was bypassed. Listen/Read: https:// hackread.com/claude-code-deskt op-flaw-html-steal-credentials/ # Cybersecurity # Cla…

    链接 hackread.com/claude-code-desktop-flaw-htm…

相关实体

相关话题