Security researchers discover arbitrary file read vulnerability in Claude Code Desktop preview pane

Security researchers at Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution, using poisoned HTML files in public repositories that bypass the preview sandbox and run JavaScript without Content Security Policy protection. Anthropic scored the vulnerability CVSS 8.7 (High) and treated it as equivalent to code execution on the host machine.

Security researchers discover arbitrary file read vulnerability in Claude Code Desktop preview pane Security researchers at Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution. The attack uses poisoned HTML files in public repositories that bypass the preview sandbox and run JavaScript without Content Security Policy protection. Anthropic scored the vulnerability CVSS 8.7 High and treated it as equivalent to code execution on the host machine. Topics Sources - Press Read article https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data Go deeper This intelligence is sourced automatically from public sources across the web and synthesised by the Prefactor AI pipeline. Stories are reviewed before publication.