CVE-2026-47092
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Claude HUD through version 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.
Risk Assessment
The risk for the organization is the potential for local privilege escalation and arbitrary code execution on Windows systems by an attacker with local access, which could lead to system compromise, data theft, or malware installation.
Recommendation
Immediately update Claude HUD to a version containing commit 234d9aa or later, and restrict local access to Windows systems running the vulnerable version.
Other vulnerabilities in Claude HUD
See all- CVE-2026-47091Low
Claude HUD through version 0.0.12 contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. File metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.
- CVE-2026-47090Medium
A vulnerability in Claude HUD up to version 0.0.12 (fixed in commit 234d9aa) allows injection of arbitrary ANSI codes into terminal sessions due to improper construction of OSC 8 hyperlink escape sequences. Attackers can embed ESC+backslash sequences in the current working directory or branch URL, leading to execution of malicious ANSI codes such as text color changes, forged prompts, OSC 52 clipboard writes, or outbound HTTP requests when hyperlinks are clicked.
Original NVD description (English source)
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.