{"data":{"id":"5a1dee36-441b-4317-aedc-a5fa7e647124","title":"CVE-2026-47090: Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw…","summary":"Claude HUD through 0.0.12 builds OSC 8 terminal hyperlink escape sequences from raw cwd and branchUrl values without stripping control characters or encoding embedded content, enabling injection of arbitrary ANSI codes into terminal sessions. An attacker who embeds ESC+backslash sequences in the working directory or branch URL can change text colors, forge prompts, write to the clipboard via OSC 52, or trigger outbound HTTP requests to attacker-controlled remotes when a hyperlink is clicked.","solution":"Patched in commit 234d9aa.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47090","publishedAt":"2026-05-18T20:16:39.673Z","cveId":"CVE-2026-47090","cweIds":["CWE-150"],"cvssScore":"4.6","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Claude HUD"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude HUD terminal escape injection through unsanitized cwd and branchUrl","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00149,"epssCheckedAt":"2026-10-14T06:09:07.529Z","kevDateAdded":null,"advisoryAliases":["GHSA-f378-wf84-8j5h"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:48:16.266Z","patchAvailable":null,"disclosureDate":"2026-05-18T20:16:39.673Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}