Noma Labs says Claude Code Desktop preview pane could leak local credentials
Proof of concept
Manipulation
Severity 3 significant
Reported 70%
Added by the register agent
Noma Labs researchers reported an exploit chain in Claude Code Desktop's preview pane. A poisoned HTML coverage report in a public repo ran JavaScript that read local files, including SSH keys and cloud credentials, and sent them out. Anthropic scored the issue CVSS 8.7, shipped a partial patch, and later issued a fix that the researchers' bypass had shown was needed.
What would have stopped it
Sandboxing rendered content with layered, consistently applied controls such as CSP and file access filters across every rendering path.
Guardrails
- G1 Least privilege Failed Preview pane could read arbitrary local file paths through the file:// origin.
- G2 Human confirmation Failed Victim was not asked to approve any file access; a routine request triggered it.
- G3 Isolation Failed Renderer sandbox was bypassed, including via a Web Worker from a blob URL.
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Partial Fix shipped in Claude Desktop 1.30096.1 via auto-update; prior exfiltration not addressed.
Sources
-
“Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution.”
Confidence 70% comes from these sources alone. How we score
History
- 16 Oct 2026Drafted by the register agent from Noma Security (register agent)