Claude Code Desktop flaw SneakPeek exposed developer secrets

Noma Security found a flaw in Anthropic's Claude Code Desktop app that let malicious JavaScript in an HTML file run in the preview pane without user interaction, potentially leaking AWS credentials, GitHub secrets and SSH keys. Anthropic rated it CVSS 8.7 and fully resolved the issue, with a GitHub Security Advisory and CVE pending.

• SneakPeek was rated CVSS 8.7 (High)
• Files over 256KB loaded via file://, bypassing CSP
• The first patch was bypassed via a Web Worker
• Anthropic is preparing a GitHub Security Advisory and CVE