High · published February 3, 2026
⚡ Just a single character flaw in URL validation could let attackers hijack requests and pull data from your system! Think of it like a restaurant that barely checks the reservation names, allowing anyone to call in and steal food orders meant for others — all because they slipped in a sneaky name that sounds close enough to fool the staff. Without proper validation, attackers could easily craft domains that appear trusted, making automatic requests to those malicious sites without any user consent. This could lead to absolutely devastating data exfiltration, compromising sensitive information and putting your security at risk.
Think of it like a restaurant that barely checks the reservation names, allowing anyone to call in and steal food orders meant for others — all because they slipped in a sneaky name that sounds close enough to fool the staff. The vulnerability exists in Claude Code's use of the startsWith() function for validating trusted domains during WebFetch requests. This inadequate check allows crafted malicious domains to bypass verification and gain unauthorized access.
Without proper validation, attackers could easily craft domains that appear trusted, making automatic requests to those malicious sites without any user consent. This could lead to absolutely devastating data exfiltration, compromising sensitive information and putting your security at risk. Upgrade to version 1.0.111 to patch this vulnerability immediately. Additionally, review your URL validation mechanisms to ensure that they properly check domain legitimacy without allowing malicious variations. Implementing a more robust validation approach is key! You've got this! Take these steps, and you'll be back on solid ground in no time! 🛡️