Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration

Summary: Check Point researchers Aviv Donenfeld and Oded Vanunu disclosed vulnerabilities in Anthropic's Claude Code that execute arbitrary shell commands and exfiltrate Anthropic API keys when users clone and open untrusted repositories. In CVE-2026-21852, a repository settings file setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint causes Claude Code to issue API requests before showing the trust prompt, leaking the user's API keys; CVE-2025-59536 uses .mcp.json and claude/settings.json to override explicit user approval via the enableAllProjectMcpServers option.
Bottom line: Opening a repository is now enough to hand over a developer's active API key and redirect authenticated API traffic to external infrastructure, which Check Point says can extend to accessing shared project files, modifying or deleting cloud-stored data, and generating unexpected API costs.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-59536 CVE-2026-21852
Related: Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026