CVE-2026-88066
Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.
| CWE | CWE-427 |
| Vendor | anthropics |
| Product | claude-code |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for anthropics claude-code
Be the first to know when new unknown vulnerabilities affecting anthropics claude-code are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
anthropics / claude-code
< 1.8089.0