HIGH 7.5 NVD

CVE-2026-88066

Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn wit

Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84

Published: 2026-11-03 · Source: NVD · Feed updated: 2026-11-04

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-11-03 via NVD.

vulnfeed aggregates 18613 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.