CVE-2026-47092

Katalog CVE

CVSS 7.8 · High EPSS 0,89%

Kerentanan Uncontrolled Search Path Element pada jarrodwatts claude hud. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,89% peluang dieksploitasi; lebih tinggi dari 58,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30 patch
• https://github.com/jarrodwatts/claude-hud/pull/487 issue tracking · patch
• https://www.vulncheck.com/advisories/claude-hud-arbitrary-command-execution-via-comspec-environment-variable advisory pihak ketiga
• https://github.com/jarrodwatts/claude-hud/issues/485 issue tracking