CVE-2026-47092

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30	Patch
https://github.com/jarrodwatts/claude-hud/issues/485	Issue Tracking
https://github.com/jarrodwatts/claude-hud/pull/487	Issue Tracking Patch
https://www.vulncheck.com/advisories/claude-hud-arbitrary-command-execution-via-comspec-environment-variable	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jarrodwatts:claude_hud:*:*:*:*:*:claude_code:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Claude HUD hasta la versión 0.0.12, parcheado en el commit 234d9aa, contiene una vulnerabilidad de inyección de comandos que permite a atacantes locales ejecutar comandos arbitrarios manipulando la variable de entorno COMSPEC. Los atacantes pueden establecer COMSPEC a una ruta binaria arbitraria antes de que claude-hud realice su verificación de versión, haciendo que execFile() ejecute el ejecutable proporcionado por el atacante con argumentos de cmd.exe, lo que resulta en ejecución de código arbitrario en sistemas Windows.

Information

Published : 2026-05-18 20:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-47092

Mitre link : CVE-2026-47092

CVE.ORG link : CVE-2026-47092

JSON object : View

Products Affected

jarrodwatts

claude_hud

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-47092", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47092", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T16:24:48.795343Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/jarrodwatts/claude-hud", "vendor": "jarrodwatts", "product": "claude-hud", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.0.12"}, {"status": "unaffected", "version": "234d9aad919b51326a43bcf90b45ae35c23afc30", "versionType": "git"}], "packageURL": "pkg:github/jarrodwatts/claude-hud", "defaultStatus": "affected"}]}], "published": "2026-05-18T20:16:40.040", "references": [{"url": "https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/jarrodwatts/claude-hud/issues/485", "tags": ["Issue Tracking"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/jarrodwatts/claude-hud/pull/487", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/claude-hud-arbitrary-command-execution-via-comspec-environment-variable", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems."}, {"lang": "es", "value": "Claude HUD hasta la versi\u00f3n 0.0.12, parcheado en el commit 234d9aa, contiene una vulnerabilidad de inyecci\u00f3n de comandos que permite a atacantes locales ejecutar comandos arbitrarios manipulando la variable de entorno COMSPEC. Los atacantes pueden establecer COMSPEC a una ruta binaria arbitraria antes de que claude-hud realice su verificaci\u00f3n de versi\u00f3n, haciendo que execFile() ejecute el ejecutable proporcionado por el atacante con argumentos de cmd.exe, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario en sistemas Windows."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jarrodwatts:claude_hud:*:*:*:*:*:claude_code:*:*", "vulnerable": true, "matchCriteriaId": "926F7E0C-FF47-463B-88BF-B5227655DDD1", "versionEndIncluding": "0.0.12"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}