Vulnerability · Published Nov 3, 2026 · Assigned by GitHub_M
CVE-2026-88066Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
High 7.5
In plain English
A high-severity uncontrolled search path in claude-code from anthropics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| anthropics | claude-code | < 1.8089.0 |
Weakness: CWE-427 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N