Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

Claude Code had a flaw where it checked if a website URL started with a trusted domain name, but didn't check where the domain actually ended. An attacker could register a fake domain like 'modelcontextprotocol.io.example.com' that would pass the check, tricking the tool into automatically sending requests to their server and stealing data.

The vulnerability exists in the trusted domain validation logic for WebFetch requests, which uses a startsWith() comparison instead of proper domain boundary validation. An attacker can register a subdomain or parent domain that begins with a legitimate trusted domain name to bypass validation and trigger automatic requests to attacker-controlled infrastructure, potentially exfiltrating sensitive data without user interaction. The issue is fixed in version 1.0.111.