{"data":{"id":"0f0273f8-0d26-42b3-8fa3-b7a3b383580e","title":"CVE-2026-45136: claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2…","summary":"claude-code-cache-fix, a cache optimization proxy for Claude Code, is affected from 3.5.0 to before 3.5.2. In tools/quota-statusline.sh, introduced in v3.5.0, Claude Code's hook stdin payload is interpolated directly into a Python triple-quoted string literal. A ''' sequence in any user-controlled payload field closes the literal early, so following bytes execute as Python in the user's Claude Code process.","solution":"Fixed in 3.5.2.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45136","publishedAt":"2026-05-27T21:16:18.523Z","cveId":"CVE-2026-45136","cweIds":["CWE-78","CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["claude-code-cache-fix@>= 3.5.0, < 3.5.2 (fixed: 3.5.2)"],"affectedPackageNames":["claude-code-cache-fix"],"affectedPackageRefs":["npm:claude-code-cache-fix"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","claude-code-cache-fix"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"claude-code-cache-fix code injection through quota-statusline.sh hook payload","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00214,"epssCheckedAt":"2026-10-14T18:05:59.956Z","kevDateAdded":null,"advisoryAliases":["GHSA-g3xq-3gmv-qq8g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:04.065Z","patchAvailable":true,"disclosureDate":"2026-05-27T21:16:18.523Z","capecIds":["CAPEC-242","CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}