{"id":"CVE-2026-88066","kind":"vulnerability","aliases":["CVE-2026-88066"],"related":[],"title":"Claude Desktop on Windows runs a planted git.exe from opened repositories","description":"Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.","summary":"Claude Desktop on Windows launches git.exe without an absolute path, so Windows can pick a malicious git.exe sitting in the opened project's folder. Opening an attacker-controlled or shared repository runs that program with the user's privileges.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","claude-desktop","git","windows"],"not_affected_if":["fixed-version","non-windows","trusted-repos-only"],"how_to_check":"- Open Claude Desktop and check the installed version against the fixed release in Fix.","fix":"- Claude Desktop on Windows: `1.8089.0` or later.","status":"open","published_at":"2026-11-03T20:18:18+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:50:12+00:00","updated_at":"2026-11-03T20:50:12+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-03T20:50:12Z","model":"claude-haiku-5-5","output":{"fix":"- Claude Desktop on Windows: `1.8089.0` or later.","reach":"local","title":"Claude Desktop on Windows runs a planted git.exe from opened repositories","impact":"high","summary":"Claude Desktop on Windows launches git.exe without an absolute path, so Windows can pick a malicious git.exe sitting in the opened project's folder. Opening an attacker-controlled or shared repository runs that program with the user's privileges.","audience":"everyone","category":"ai-tooling","nicknames":[],"who_cares":["claude-desktop","windows","git"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker code runs with the user's privileges on their Windows machine.","analyst_note":"","how_to_check":"- Open Claude Desktop and check the installed version against the fixed release in Fix.\n- unknown for other checks; the sources do not say.","plain_action":"Update Claude Desktop on Windows to version 1.8089.0 or later, and only open repositories you trust until you have updated.","needs_analyst":false,"not_affected_if":["fixed-version","trusted-repos-only","non-windows"],"who_is_affected":"Windows users of Claude Desktop prior to 1.8089.0 who open repositories from untrusted or shared sources. Exposure depends on a malicious git.exe being placed in the project's working directory. Users on macOS or Linux, or who only open their own trusted projects, are less exposed according to the description, which names only Windows.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4193,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88066':14A,17A '1.8089.0':79C,143C 'absolut':34B,91C 'ai':19B 'ai-tool':18B 'allow':93C 'anthrop':69C 'applic':72C 'attack':53B,121C 'attacker-control':52B,120C 'claud':1A,22B,26B,66C,76C,80C 'claude-desktop':21B 'control':54B,122C 'current':110C 'cve':12A,15A 'desktop':2A,23B,27B,67C,71C,81C 'directori':112C 'execut':117C,128C 'fix':140C 'folder':49B 'git':24B 'git.exe':8A,31B,42B,85C,103C 'intend':115C 'interact':74C 'invok':84C 'issu':138C 'launch':30B 'malici':41B,102C 'open':10A,46B,50B,107C,118C 'path':35B,92C,97C 'pick':39B 'place':104C 'plant':7A 'prior':77C 'privileg':65B,136C 'program':60B,131C 'project':47B,108C 'repositori':11A,57B,125C 'resolut':98C 'run':5A,58B 'search':96C 'search-path':95C 'select':100C 'share':56B,124C 'sit':43B 'spawn':88C 'substitut':130C 'system':116C 'therefor':127C 'tool':20B 'user':63B,134C 'uv':87C 'version':142C 'window':4A,25B,29B,37B,83C,94C 'without':32B,89C 'work':111C","nicknames":[],"mitigations":[],"who_affected":"Windows users of Claude Desktop prior to 1.8089.0 who open repositories from untrusted or shared sources. Exposure depends on a malicious git.exe being placed in the project's working directory. Users on macOS or Linux, or who only open their own trusted projects, are less exposed according to the description, which names only Windows.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Claude Desktop on Windows to version 1.8089.0 or later, and only open repositories you trust until you have updated.","pkeys":[],"ptokens":[],"labels":["aitooling","claudedesktop","git","high","windows"],"campaign_type":null,"first_public_at":"2026-10-13T12:24:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88066","severity":null,"published_at":"2026-11-03T20:18:18+00:00","modified_at":"2026-11-03T20:33:04+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null}],"documents":[{"id":60622,"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-13T12:24:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}