CVE-2026-54316: a pre-approved HuggingFace domain became an exfiltration endpoint.

The GitLab advisory covers out-of-band data exfiltration from Claude Code via a domain sitting on the static WebFetch allowlist. The generalizable lesson is the one to keep: any allowlisted domain that lets third parties host arbitrary content is a legal exfil channel. Audit your allowlists by asking "can an attacker put a file here?" not "is this vendor reputable?" HuggingFace is extremely reputable. It also lets anyone upload a file.