# Security researchers discover arbitrary file read vulnerability in Claude Code Desktop preview pane

> Source: <https://www.getreadyforagents.com/news/noma-labs-claude-code-preview-pane-exfiltration/>
> Published: 2026-10-16 19:06:51+00:00

# Security researchers discover arbitrary file read vulnerability in Claude Code Desktop preview pane

Security researchers at Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution. The attack uses poisoned HTML files in public repositories that bypass the preview sandbox and run JavaScript without Content Security Policy protection. Anthropic scored the vulnerability CVSS 8.7 (High) and treated it as equivalent to code execution on the host machine.

## Topics

## Sources

- Press[Read article](https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data)

## Go deeper

This intelligence is sourced automatically from public sources across the web and synthesised by the Prefactor AI pipeline. Stories are reviewed before publication.