SneakPeek: Noma Labs shows Claude Code Desktop's preview pane could run JavaScript from a poisoned HTML file over 256 KB and silently send SSH keys, cloud credentials and tokens to an attacker; Anthropic rated it CVSS 8.7 and fixed it in Claude Desktop 1.30096.1
Noma Labs published SneakPeek on 14 October 2026, an exploit chain in the preview pane of Claude Code Desktop, the desktop app's coding interface. When Claude reads or edits an HTML file, the pane renders it automatically. Files under 256 KB load as data: URLs with a Content Security Policy that blocks scripts. Files over 256 KB were written to a temporary file and loaded from file://, where the CSP was not applied. The request filter meant to stop local file reads only worked when the pane was proxying a dev server, not when rendering a static file from disk. Noma's proof of concept hid a payload in an oversized test-coverage report in a public repo. Once the victim cloned it and asked Claude to look at the report, the script read SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes and Docker credentials, Git tokens and Claude's own OAuth tokens. It then sent them out with navigator.sendBeacon, and could leak the user's real IP address through WebRTC, with no permission prompt. Noma reported it on 4 July 2026. Anthropic scored it 8.7 (CVSS 4.0, high) and treated it as equivalent to code execution on the host. Its first patch blocked file:// fetches from the page, but Noma bypassed that with a Web Worker created from a blob: URL. Anthropic then shipped a complete fix in Claude Desktop 1.30096.1 (17 August 2026), delivered by auto-update. Noma says a GitHub advisory and CVE are still pending. No in-the-wild exploitation is reported. Separate from the Claude Code plugin SHA-pin bypass (CVE-2026-86063) on this desk.
- Product
- Anthropic Claude Desktop (Claude Code Desktop preview pane, Electron)
- Versions
- Claude Desktop before 1.30096.1. Fixed: 1.30096.1 and later (17 Aug 2026, auto-update).
- CVSS
- 8.7 (CVSS 4.0, Anthropic, as reported by Noma Labs); no CVE yet
- Exploited in Australia?
- unknown
- Patch to
- Make sure Claude Desktop is on 1.30096.1 or later (auto-update should have applied it; update by hand where it is turned off). Treat HTML files in cloned repos, such as coverage reports, as untrusted, and rotate SSH keys, cloud keys and tokens on any developer machine that ran an older build against untrusted repositories.
Primary: Noma Labs — SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data (14 Oct 2026) · Vendor: Anthropic — Claude Code GitHub security advisories (advisory and CVE for this issue pending, per Noma) · CVE: CVE-2026-86063