CVE-2026-45136

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada cnighswonger claude-code-cache-fix. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g mitigasi · advisory vendor
• https://github.com/cnighswonger/claude-code-cache-fix/pull/110 issue tracking · patch
• https://github.com/cnighswonger/claude-code-cache-fix/issues/108 exploit · issue tracking