High severity · published Jan 21, 2026
CVE-2026-21852
Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation
7.5
CVSS
27.5%
EPSS
No
On KEV
Description
Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)27.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
claude-code · anthropics
< 2.0.65 · source: vendor
CC
Claude Code · Anthropic
before 2.0.65 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21852
Vendor Advisory
https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7
More from claude-code
10.0
CVE-2026-39861
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
10.0
CVE-2026-25725
Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json
9.8
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
9.8
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
9.8
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog