HighVulnerabilityLLM-specific
CVE-2026-88066: Claude Desktop on Windows git.exe execution via search path
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-88066
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Claude Desktop on Windows, prior to 1.8089.0, calls git.exe through uv_spawn without an absolute path. Windows search-path resolution can therefore pick a malicious git.exe placed in the opened project's current working directory, so opening an attacker-controlled or shared repository executes the substituted program with the user's privileges.
Mitigation
Fixed in version 1.8089.0.
Related items
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
- HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
- MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
- MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database
- MediumGHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasSame vendor · GitHub Advisory Database