On 14 October 2026, Eli Ainhorn at Noma Labs published SneakPeek. The post describes a bug in the preview pane of Claude Code Desktop. Noma says Anthropic scored it 8.7 (High) on CVSS v4.0, treated the impact as equivalent to code execution on the host, and fixed it in Claude Desktop 1.30096.1 and later, issued 17 August 2026 and delivered by auto-update. This is a disclosure of a bug Noma says is already fixed.
What Noma says the pane did
Noma writes that the preview pane renders an HTML file when Claude reads or edits it, inside Electron’s Chromium. Files under 256 KB loaded as data: URLs, which limit what a script can reach, and those files received a Content Security Policy that blocks scripts. Files over 256 KB were written to a temp file and loaded as file://. Noma says that path did not get the policy, so JavaScript in the large file could run. A request filter meant to block file:// reads, Noma says, did not engage when the pane rendered a static HTML file from disk, such as a coverage report. It did engage when the pane was proxying a running dev server.
With those gaps together, Noma says a script could read local files and send them out. The list in the post includes SSH private keys, AWS access keys, npm and GitHub tokens, Kubernetes credentials, Docker registry auth, Git identity and tokens, and Claude’s own OAuth tokens. The summary also names the machine’s IP address via WebRTC. Those are Noma’s findings. This account did not reproduce them.
Noma’s example is a poisoned HTML file in a public repository, padded past 256 KB so it looks like an ordinary coverage report. A person clones the repo and asks Claude to look at the file. Noma says the pane then renders it without a further permission prompt.
A first patch, and a bypass
Noma says Anthropic’s first patch blocked fetch() and XMLHttpRequest calls to file:// from the main page. Noma says that patch was bypassed by moving the read into a Web Worker created from a blob: URL, a context the filter did not cover, and that the same local files could still be read. The proof-of-concept code is on Noma’s page. It is not repeated here.
Noma’s timeline is: reported 4 July 2026; scored 8.7 on 9 July; a patch and a bypass both on 24 July; Anthropic confirmed the fix was incomplete on 3 August and moved the report back to triaged; a fix in Claude Desktop 1.30096.1 and later on 17 August, by auto-update. The October 2026 line says a GitHub advisory and a CVE were still pending publish. Noma says that after a final retest Anthropic closed the vulnerability and marked it resolved. That closing statement is Noma’s.
No advisory found on 15 October
GitHub issue searches opened on 15 October 2026, for a SneakPeek advisory and for “SneakPeek” in an issue title, did not return a GHSA or a CVE record for this bug. Anthropic has not posted the score or the fix version on a page opened for this story. Both figures stay as Noma reports them.
What to check
Check the Claude Desktop version that is actually running. Noma’s floor is 1.30096.1, dated 17 August 2026. An update can sit unapplied until the app restarts, so a machine that has not relaunched since mid-August can still be on the old build. A fleet that pins versions needs the same check against that floor.
The Campfire
No commentsNobody has pulled up a log by this one yet. Be the first to say what you make of it.
Held for the desk. It appears after a look.