Claude Code Desktop Vulnerability: Preview Pane Data Exfiltration

Eli Ainhorn published Noma Labs' SneakPeek on October 14, 2026. noma.security's report describes a Claude Code Desktop preview-pane chain that reads arbitrary local files through unrestricted JavaScript. Poisoned HTML in a public coverage report bypasses the preview sandbox. The victim clones the repo and asks Claude to review the file. The pane renders it and runs the payload. Anthropic scored it CVSS 8.7 (High) on CVSS v4.0 and treated the impact as equivalent to code execution on the host.

Developers who open public repos in Claude Code Desktop and keep API keys, SSH private keys, cloud credentials, or Claude OAuth tokens are the audience. It covers the sandbox layers, the July 24, 2026 patch, and the Worker bypass. Anthropic delivered the fix in Claude Desktop 1.30096.1 and later on August 17, 2026, by auto-update.

What shipped in Claude Code Desktop Vulnerability

The preview pane renders HTML when Claude reads or edits an HTML file. Noma Labs calls it an artifact renderer on Electron's Chromium engine. The victim does not open a URL. Three controls apply. A Content Security Policy with script-src 'none' blocks JavaScript. A data: URL gives an opaque origin so the page cannot fetch local files. A request filter on the dev server proxy limits outbound fetches. Noma Labs bypassed all three, and the pane renders the file automatically.

Files under 256KB load as data: URLs, which restrict scripts, and the CSP covers only that path. Files over 256KB are written to a temp file and loaded as file:// URLs. Chromium gives file:// same-origin fetch() access to the local filesystem, and without the CSP the script runs unrestricted. A proxied React or Node dev server enables the filter, blocking file:// reads. Static HTML on disk, such as a coverage report, leaves the filter off, so fetch() reads the filesystem.

What improved in Claude Code Desktop Vulnerability

The first patch blocked fetch() and XMLHttpRequest to file:// from the main page. Noma Labs moved the read into a Web Worker from a blob: URL, outside that filter. The worker returned file contents to the main thread, which sent them with navigator.sendBeacon(), a one-way HTTP POST. All three original defects stayed exploitable. On August 3, 2026, Anthropic confirmed the fix was incomplete, moved the report back to Triaged, and committed to cover CSP, file:// loading, and the Worker bypass.

After the final retest, Anthropic fixed all issues, closed the vulnerability, and marked it resolved in Claude Desktop 1.30096.1 and later, issued August 17, 2026, via auto-update. July 4, 2026 was the initial report with a proof of concept. July 9, 2026 was triage at CVSS 8.7 (High) using CVSS v4.0. July 24, 2026 brought the first patch, a retest request, and Noma Labs' bypass with a video walkthrough. In October 2026 the GitHub Advisory and CVE were still pending.

What you gain from Claude Code Desktop Vulnerability

Claude Desktop 1.30096.1 and later is the release Anthropic marked resolved, covering the CSP gap, file:// loading, and the Worker bypass of the July 24 filter. Before that build, no permission dialog asked the victim to approve filesystem access or inspect the report contents. Asking Claude to view the coverage report was enough to render the preview, run the payload, and start the exfiltration. No permission request appeared. Claude rendered the untrusted HTML, and the code ran in that step.

The proof of concept read SSH private keys, AWS access keys and secrets, npm and GitHub auth tokens, Kubernetes cluster credentials, Docker registry auth, and Git identity and tokens. API keys, Claude OAuth tokens, and the real IP via WebRTC were included. navigator.sendBeacon() sent them because the app is Electron on a full Chromium engine, with standard web APIs. Noma Labs noted that a 500KB report "doesn't raise any flags" because coverage repos bundle source maps and CSS. Their file was over 256KB.

How to get Claude Code Desktop Vulnerability

Anthropic's resolved release is Claude Desktop 1.30096.1 and later, issued August 17, 2026 and delivered by auto-update. The disclosure timeline names auto-update as the delivery path. Earlier points are the July 4, 2026 proof-of-concept report, July 9 triage at CVSS 8.7 (High) under CVSS v4.0, and the July 24 patch. No other build number is named as the fix. The matching install is Desktop 1.30096.1 or newer from that auto-update, after the final retest, named in the August 17 entry.

The July 24, 2026 patch blocked direct fetch() and XMLHttpRequest calls to file:// from the renderer, and Anthropic asked for a retest that day. The bypass returned the same day: a Web Worker from a blob: URL still read local files, submitted with a full proof of concept and a video walkthrough. On August 3, 2026 Anthropic confirmed the fix was incomplete and moved the report back to Triaged, with a complete fix in progress. Closure is Claude Desktop 1.30096.1.

What to watch after Claude Code Desktop Vulnerability

The October 2026 entry from Noma Labs says the GitHub Advisory and CVE were pending publication. Stated figures are the July 9, 2026 score, CVSS 8.7 (High) under CVSS v4.0, and Claude Desktop 1.30096.1 and later. The July 4 report included a full proof of concept of credential exfiltration by arbitrary JavaScript in the file preview pane. On August 3 the fix for CSP, file:// loading, and the Worker bypass was in progress. Anthropic issued that fix on August 17.

The demo repo looked like a normal project: source files, tests, and a coverage report. The prompt reviewed test results or modules with coverage gaps. Claude read the file, the preview rendered it, and the payload executed in the pane. The script resolved the home directory from the temp file path and read files with fetch() and XMLHttpRequest. The reads hit the filesystem because static HTML leaves the request filter off. Resolved status applies to Claude Desktop 1.30096.1 and later.