CVE-2026-47091

Katalog CVE

CVSS 3.3 · Low EPSS 0,16%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada jarrodwatts claude hud. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30 patch
• https://github.com/jarrodwatts/claude-hud/pull/487 issue tracking · patch
• https://www.vulncheck.com/advisories/claude-hud-path-traversal-via-transcript-path advisory pihak ketiga
• https://github.com/jarrodwatts/claude-hud/issues/485 issue tracking