Claude Desktop CVE-2026-88066

Requires all of: (1) Claude Desktop on Windows at a version prior to 1.8089.0; (2) the victim opening an attacker-controlled or shared project directory (e.g., a cloned Git repository) in Claude Desktop - this is the UI:A active user interaction; (3) a malicious git.exe placed in that project's current working directory, which Windows search-path resolution selects before the legitimate system git.exe when uv_spawn runs git without an absolute path. Limiting factors: exploitation is gated on the user choosing to open the hostile repository, and execution occurs only at the user's existing privilege level (no elevation). It is independent of explicit confirmation dialogs beyond opening the project. Users on standard Claude Desktop auto-update have already received the fix; only manual-update users remain exposed.

This is a genuine, actionable code-execution flaw (CWE-427 uncontrolled search path) rather than an inflated high-CVSS issue, but it is not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) shows network-reachable, unauthenticated, low-complexity exploitation with full VC:H/VI:H/VA:H impact - consistent with arbitrary code execution at the user's privilege level. The two tempering signals are UI:A (the victim must open the attacker-controlled repository) and AT:P (an attack requirement beyond the attacker's control - Windows search-path resolution must select the planted git.exe from the CWD before the real one). The vuln.today decision label is 'this_week', not act_now/emergency, which aligns with that profile. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or at-scale exploitation; risk is driven by the severity of the outcome and the plausibility of supply-chain delivery (shared/cloned repositories) rather than by observed exploitation. Note the input Tags label this 'Information Disclosure', which conflicts with the advisory: the actual impact is arbitrary code execution, so the risk is higher-integrity/availability than an info-disclosure label would imply - treat the tag as wrong, not the advisory.

An attacker commits a malicious git.exe into the root of a shared or public Git repository. When a victim clones that repository and opens it as a project in Claude Desktop on Windows (version prior to 1.8089.0), Claude Desktop spawns git.exe via uv_spawn without an absolute path; Windows resolves the current working directory first and runs the attacker's binary with the user's privileges. No public exploit code is identified in the input, though the mechanism is fully described in the GitHub advisory.