{"data":{"id":"0b2f4df0-4649-47c2-86dc-591a592e9172","title":"CVE-2026-47092: Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local…","summary":"CVE-2026-47092 affects Claude HUD through 0.0.12, patched in commit 234d9aa. A local attacker who sets the COMSPEC environment variable to an arbitrary binary path can cause claude-hud's version check to run that executable through execFile() with cmd.exe arguments. The result is arbitrary code execution on Windows systems. VulnCheck rates it CVSS 4.0 7.3 (High), and NIST has not yet provided an assessment.","solution":"Patched in commit 234d9aa.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47092","publishedAt":"2026-05-18T20:16:40.040Z","cveId":"CVE-2026-47092","cweIds":["CWE-427"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Claude HUD"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude HUD command injection via COMSPEC environment variable","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00892,"epssCheckedAt":"2026-10-14T18:05:59.791Z","kevDateAdded":null,"advisoryAliases":["GHSA-p5qq-v9mc-39ff"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:48:15.213Z","patchAvailable":null,"disclosureDate":"2026-05-18T20:16:40.040Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}