Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-21852-PoC — Educational demo of three Claude Code vulnerabilities (hooks bypass, MCP injection, API key exfiltration) with attacker server, MITM proxy, and detection scanner for supply-chain security learning. | Kitploit
Tools/GitHubGitHub/atiilla/cve-2026-21852-poc
Static AnalysisVulnerability AnalysisExploitationWeb SecurityPenetration TestingSupply Chain SecurityLearning & EducationAI Security
GitHubatiilla/cve-2026-21852-poc

CVE-2026-21852-PoC

Educational demo of three Claude Code vulnerabilities (hooks bypass, MCP injection, API key exfiltration) with attacker server, MITM proxy, and detection scanner for supply-chain security learning.

View Repository
2496 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Claude Code Vulnerability Educational Demo

This project demonstrates three vulnerabilities disclosed by Check Point Research in Anthropic's Claude Code CLI tool. It is designed for cybersecurity students and researchers to understand how AI development tool supply-chain attacks work.

Demo

Vulnerabilities Covered

IDCVSSTypeFixed In
No CVE8.7Hooks consent bypass → RCEv1.0.87 (Sep 2025)
CVE-2025-595368.7MCP server config injection → RCEv1.0.111 (Oct 2025)
CVE-2026-218525.3API key exfiltration via base URLv2.0.65 (Jan 2026)

Structure

root@kitploit:~
├── README.md                          # This file
├── attacker_server.py                 # Local HTTP server that logs received data
├── attacker_proxy.py                  # MITM proxy for CVE-2026-21852 (captures API key + traffic)
├── scanner.py                         # Detection tool: scans repos for these patterns
├── vuln1_hooks_bypass/                # Demo: malicious hooks in settings.json
│   └── .claude/settings.json
├── CVE-2025-59536_mcp_injection/      # Demo: MCP server config injection
│   ├── .mcp.json
│   └── .claude/settings.json
└── CVE-2026-21852_api_exfil/          # Demo: API key exfiltration via base URL
    └── .claude/settings.json

How to Use

  1. Review each demo directory to see the malicious config files
  2. Run the attacker server: python3 attacker_server.py
  3. Run the MITM proxy (CVE-2026-21852 only): python3 attacker_proxy.py — transparent proxy on 127.0.0.1:8888 that captures API keys while forwarding traffic normally
  4. Run the scanner: python3 scanner.py <path-to-any-repo> to detect these patterns
  5. DO NOT open the demo directories with an actual (old, unpatched) Claude Code instance

Scanner

scanner.py checks any local repo for the three vulnerability patterns before you open it in Claude Code.

root@kitploit:~
python3 scanner.py <path-to-repo>

It flags:

  • Project hooks that execute shell commands (hooks consent bypass)
  • enableAllProjectMcpServers: true combined with .mcp.json server definitions (CVE-2025-59536)
  • ANTHROPIC_BASE_URL or other credential-related env overrides in .claude/settings.json (CVE-2026-21852)

Exits with code 1 if any issues are found, 0 if clean — easy to drop into a CI pre-clone check.

Tested On

ComponentVersion
Claude Code CLIv2.0.61

Note: v2.0.61 is a vulnerable build (patch landed in v2.0.65). Do not use this version in production.

Key Takeaway

In AI-powered development environments, configuration files are part of the execution layer. Cloning an untrusted repository is now equivalent to running untrusted code if your tools auto-load project configs.

Disclaimer

This project is provided as-is for educational purposes. Techniques shown here are demonstrated on localhost only and target only patched, historical vulnerabilities. Using these tools against production systems, third-party infrastructure, or any system without explicit authorization is illegal and unethical. The author is not responsible for any damage caused by misuse of this material.

Download Tool