Claude Code Desktop vulnerability allows credential exfiltration via malicious HTML file

A malicious HTML file in a public repository could silently exfiltrate credentials, keys and tokens from Claude Code Desktop because the preview pane rendered large files as file:// URLs with direct local filesystem access instead of inside its sandbox.

Detected & updated continuously · Source: Nebula