Unverified50% confidenceFactExact time
An attacker can induce a user to open a malicious HTML file larger than 256KB and use the preview panel to read SSH private keys and cloud service credentials (such as AWS and GCP access keys).
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/15/2026
First Seen
Valid until: 1/13/2027
Sources
Related Entities
Related Claims
UnverifiedIf you have opened a suspicious HTML file, you should rotate SSH key pairs and all cloud platform access keys, check for anomalous access, audit local file access records, and notify your security team.80% similarUnverifiedThe HTML preview feature of the Claude Code Desktop application has a vulnerability that attackers can exploit using scripts hidden in preview files to read local data such as SSH private keys, AWS credentials and GitHub tokens.75% similarUnverified恶意载荷运行后会收集环境变量、SSH 密钥、云凭证、Kubernetes 服务账户令牌及各类供应商 API Key69% similarUnverifiedWoW's network traffic is encrypted, and decryption requires extracting keys from the client's runtime memory.67% similarUnverified恶意包一旦被安装，可在安装脚本或运行时读取环境变量和配置文件，窃取真实API密钥、云凭证、数据库密码等敏感信息67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1037252API
curl https://kongchang.com/api/v1/knowledge/claims/1037252MCP
get_claim(id=1037252)