{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-88066",
    "name": "CVE-2026-88066",
    "vendor": "@anthropic-ai/claude-code",
    "description": "Anthropic published two advisories in October 2026. GHSA-4p2j-qj3c-6x84 / CVE-2026-88066 (13 October, CVSS 4.0 7.5): Claude Desktop on Windows started `git.exe` without an absolute path, so Windows searched the current working directory first, and a git.exe placed in a project folder, for example in a cloned repository, ran automatically when the user opened that folder. It is fixed in Claude Desktop 1.8089.0 and credited to Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W. GHSA-5j29-h97v-84ch / CVE-2026-103435 (5 October, NVD 7 October, CVSS 4.0 7.7): Claude Code checked that a target path was inside the project when it asked for permission, but resolved the path again at write time. Someone with write access to a shared workspace who won the race could swap a project file for a symlink and redirect Claude Code's edit to a file outside the project, such as a shell profile, in a more privileged user's session. It is fixed in @anthropic-ai/claude-code 2.1.129. Separately, Noma Labs published SneakPeek on 14 October. Claude Code Desktop's preview pane loaded HTML files larger than 256 KB from a file:// URL, without the content security policy applied to smaller files, and its request filter did not apply to static files. JavaScript in a padded HTML file, disguised as a coverage report that Claude was asked to review, could therefore read SSH keys, cloud and GitHub credentials and Claude OAuth tokens and send them out with sendBeacon. Noma bypassed the first fix with a Web Worker created from a blob: URL. Anthropic scored the issue CVSS 4.0 8.7 and fixed it in Claude Desktop 1.30096.1 on 17 August; Noma says a GitHub advisory and CVE are pending. Installs on auto-update already have all three fixes. The git.exe flaw is the same untrusted-search-path class Cymulate reported in June against Copilot CLI, Gemini CLI and the Codex desktop app on Windows.",
    "website": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "@anthropic-ai/claude-code",
      "command": null
    },
    "configFiles": null,
    "category": "package",
    "updatedAt": "2026-10-13",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-88066",
      "aliases": [
        "ti-136",
        "GHSA-4p2j-qj3c-6x84"
      ],
      "title": "Claude Desktop and Claude Code: A Planted git.exe Ran on Project Open (CVE-2026-88066), a Write-Time Symlink Race Escaped the Project (CVE-2026-103435), and SneakPeek Let the Preview Pane Read Local Keys",
      "summary": "Anthropic published two advisories in October 2026. GHSA-4p2j-qj3c-6x84 / CVE-2026-88066 (13 October, CVSS 4.0 7.5): Claude Desktop on Windows started `git.exe` without an absolute path, so Windows searched the current working directory first, and a git.exe placed in a project folder, for example in a cloned repository, ran automatically when the user opened that folder. It is fixed in Claude Desktop 1.8089.0 and credited to Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W. GHSA-5j29-h97v-84ch / CVE-2026-103435 (5 October, NVD 7 October, CVSS 4.0 7.7): Claude Code checked that a target path was inside the project when it asked for permission, but resolved the path again at write time. Someone with write access to a shared workspace who won the race could swap a project file for a symlink and redirect Claude Code's edit to a file outside the project, such as a shell profile, in a more privileged user's session. It is fixed in @anthropic-ai/claude-code 2.1.129. Separately, Noma Labs published SneakPeek on 14 October. Claude Code Desktop's preview pane loaded HTML files larger than 256 KB from a file:// URL, without the content security policy applied to smaller files, and its request filter did not apply to static files. JavaScript in a padded HTML file, disguised as a coverage report that Claude was asked to review, could therefore read SSH keys, cloud and GitHub credentials and Claude OAuth tokens and send them out with sendBeacon. Noma bypassed the first fix with a Web Worker created from a blob: URL. Anthropic scored the issue CVSS 4.0 8.7 and fixed it in Claude Desktop 1.30096.1 on 17 August; Noma says a GitHub advisory and CVE are pending. Installs on auto-update already have all three fixes. The git.exe flaw is the same untrusted-search-path class Cymulate reported in June against Copilot CLI, Gemini CLI and the Codex desktop app on Windows.",
      "severity": "high",
      "cvss": {
        "score": 7.5,
        "vector": null,
        "version": "4.0"
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Path traversal",
        "Data exfiltration"
      ],
      "componentType": "package",
      "component": {
        "name": "@anthropic-ai/claude-code",
        "vendor": null,
        "package": "@anthropic-ai/claude-code",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<2.1.129",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-13",
      "modifiedAt": "2026-10-13",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88066"
        }
      ],
      "mitigation": "Confirm Claude Desktop is at 1.8089.0 or later and Claude Code at 2.1.129 or later on every workstation, CI runner and container image, especially where auto-update is turned off. On Windows, look for git.exe, npx.exe, where.exe or node.exe inside repositories and project folders and treat any you find as an indicator of compromise. Do not share a writable workspace between a less privileged user and a Claude Code session that runs with more privileges. If untrusted repository HTML was previewed in Claude Desktop before 17 August 2026, rotate the SSH keys, cloud and GitHub credentials and Claude tokens on that machine.",
      "detectedByAnomity": false
    }
  }
}