HighVulnerability

CVE-2026-47092: Claude HUD command injection via COMSPEC environment variable

Source: NVD(opens in a new tab)
Identifier: CVE-2026-47092
Published: May 18, 2026
Record updated: October 9, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.9%

Summary

CVE-2026-47092 affects Claude HUD through 0.0.12, patched in commit 234d9aa. A local attacker who sets the COMSPEC environment variable to an arbitrary binary path can cause claude-hud's version check to run that executable through execFile() with cmd.exe arguments. The result is arbitrary code execution on Windows systems. VulnCheck rates it CVSS 4.0 7.3 (High), and NIST has not yet provided an assessment.

Mitigation

Patched in commit 234d9aa.

Details

Scores and exploitation

CVSS score: 7.8(high)
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector: local
Attack complexity: low
Privileges required: low
User interaction: none
EPSS: 0.9%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 12, 2026.
Disclosure date: May 18, 2026

Weaknesses and techniques

Weakness (CWE): CWE-427

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Plugin
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-47092

First tracked: May 18, 2026 at 08:12 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 85% (self-assessed)

Summary

Mitigation

Related items