{"id":"GHSA-v234-4jrq-mgg6","kind":"vulnerability","aliases":["GHSA-v234-4jrq-mgg6"],"related":[],"title":"Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host","description":"Claude Desktop maintains a list of file types that execute code when opened, and prevents those types from being opened directly from a Cowork session's shared folder. This ensures that content written into the folder by an agent running inside the Cowork sandbox cannot execute on the host without the user intending to run it. On macOS, this list omitted a file type that the operating system executes on open. As a result, a file placed in a Cowork folder by a compromised or prompt-injected agent could run commands on the user's Mac if the user opened that file from Claude Desktop. Claude Desktop 1.15962.0 adds this and related file types to the block list.\n\nSeparately, Claude Desktop releases prior to 1.11847.5 shipped a Cowork VM image whose guest Linux kernel was affected by the upstream vulnerability CVE-2026-43284. Claude Desktop 1.11847.5 (released 9 June 2026) updated the VM image to a patched kernel. When the two issues were combined, code that had gained elevated privileges inside the VM could trigger the file open without user interaction; the severity rating above reflects the file-handling issue on its own. Claude Desktop 1.15962.0 and later include both changes.\n\nUsers on standard Claude Desktop auto-update have already received these fixes. Users performing manual or managed updates are advised to update to the latest version.\n\nIdentified internally by Anthropic. Also independently reported by Vladimir Tokarev (Cyera Research).","summary":"Claude Desktop's block list omitted a file type that macOS executes on open, so a file written into a Cowork shared folder by a compromised or prompt-injected agent could run commands on the Mac when the user opens it from Claude Desktop. The advisory also notes a combined chain with a guest Linux kernel flaw (CVE-2026-43284) that could trigger the open without user interaction.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Desktop","fixed":["1.15962.0"],"affected":">= 1.1.3918, < 1.15962.0","ecosystem":"other"}],"ecosystems":["other"],"tags":["ai-agents","ai-tooling","claude-desktop","cowork","cwe-184","macos"],"not_affected_if":["no-cowork-sessions","version-1.15962.0-or-later"],"how_to_check":"- Check the installed Claude Desktop version in the app's About screen or the app bundle's `Info.plist`, and compare it with `1.15962.0`.\n- Look for Cowork shared folders containing files of types that macOS executes on open.","fix":"- Claude Desktop: `1.15962.0` or later (fixed version per the product data).\n- Claude Desktop releases before `1.11847.5` shipped a VM image with the affected kernel; the advisory says `1.11847.5` updated it to a patched kernel.","status":"open","published_at":"2026-09-25T21:54:09+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","triaged_at":"2026-11-09T22:59:02+00:00","updated_at":"2026-11-09T22:59:02+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:59:02Z","model":"claude-haiku-5-5","output":{"fix":"- Claude Desktop: `1.15962.0` or later (fixed version per the product data).\n- Claude Desktop releases before `1.11847.5` shipped a VM image with the affected kernel; the advisory says `1.11847.5` updated it to a patched kernel.","reach":"local","title":"Claude Desktop on macOS: a malicious file in Cowork folder runs commands","impact":"high","summary":"Claude Desktop's block list omitted a file type that macOS executes on open, so a file written into a Cowork shared folder by a compromised or prompt-injected agent could run commands on the Mac when the user opens it from Claude Desktop. The advisory also notes a combined chain with a guest Linux kernel flaw (CVE-2026-43284) that could trigger the open without user interaction.","audience":"everyone","category":"ai-tooling","nicknames":[],"who_cares":["claude-desktop","cowork","macos","ai-agents"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Commands run on the user's Mac after they open a malicious file","analyst_note":"","how_to_check":"- Check the installed Claude Desktop version in the app's About screen or the app bundle's `Info.plist`, and compare it with `1.15962.0`.\n- Look for Cowork shared folders containing files of types that macOS executes on open.","plain_action":"Update Claude Desktop to version 1.15962.0 or later, since standard auto-update has already delivered this fix.","product_name":"","needs_analyst":false,"not_affected_if":["version-1.15962.0-or-later","no-cowork-sessions"],"who_is_affected":"Claude Desktop on macOS, versions from 1.1.3918 up to but not including 1.15962.0, is exposed when a user opens a file from a Cowork session's shared folder. The attack needs an agent inside the Cowork sandbox to place the file, which is what a compromised or prompt-injected agent would do. Teams using Claude Desktop with Cowork on Macs should check versions; Windows and Linux are not named in the advisory.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000883,"input_tokens":5012,"output_tokens":764,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-184':41B '-2026':102B,254C '-43284':103B,255C '1.11847.5':237C,258C '1.15962.0':220C,309C '2026':262C '4jrq':21A,26A '9':260C 'add':221C 'advis':335C 'advisori':89B 'affect':248C 'agent':32B,73B,150C,200C 'ai':31B,34B 'ai-ag':30B 'ai-tool':33B 'alreadi':324C 'also':90B,346C 'anthrop':345C 'auto':321C 'auto-upd':320C 'block':46B,229C 'cannot':156C 'chain':94B 'chang':314C 'claud':1A,37B,43B,86B,112C,216C,218C,232C,256C,307C,318C 'claude':28A 'claude-desktop':36B 'code':122C,277C 'combin':93B,276C 'command':14A,76B,203C 'compromis':68B,195C 'content':143C 'could':12A,74B,105B,201C,286C 'cowork':10A,39B,63B,135C,154C,191C,240C 'cve':101B,253C 'cwe':40B 'cyera':352C 'desktop':2A,29A,38B,44B,87B,113C,217C,219C,233C,257C,308C,319C 'direct':132C 'elev':281C 'ensur':141C 'execut':54B,121C,157C,180C 'file':7A,50B,59B,118C,174C,187C,214C,225C,289C,301C 'file-handl':300C 'fix':327C 'flaw':100B 'folder':11A,65B,139C,147C,192C 'gain':280C 'ghsa':19A,24A 'ghsa-v234-4jrq-mgg6':18A,23A 'guest':97B,244C 'handl':302C 'host':17A,160C 'identifi':342C 'imag':242C,266C 'includ':312C 'independ':347C 'inject':72B,199C 'insid':152C,283C 'intend':164C 'interact':111B,293C 'intern':343C 'issu':274C,303C 'june':261C 'kernel':99B,246C,270C 'later':311C 'latest':340C 'linux':98B,245C 'list':47B,116C,171C,230C 'mac':79B,208C 'maco':3A,42B,53B,169C 'maintain':114C 'malici':6A 'manag':332C 'manual':330C 'mgg6':22A,27A 'note':91B 'omit':48B,172C 'open':4A,56B,83B,108B,124C,131C,182C,212C,290C 'oper':178C 'patch':269C 'perform':329C 'place':188C 'prevent':126C 'prior':235C 'privileg':282C 'prompt':71B,198C 'prompt-inject':70B,197C 'rate':296C 'receiv':325C 'reflect':298C 'relat':224C 'releas':234C,259C 'report':348C 'research':353C 'result':185C 'run':13A,75B,151C,166C,202C 'sandbox':155C 'separ':231C 'session':136C 'sever':295C 'share':64B,138C 'ship':238C 'standard':317C 'system':179C 'tokarev':351C 'tool':35B 'trigger':106B,287C 'two':273C 'type':51B,119C,128C,175C,226C 'updat':263C,322C,333C,337C 'upstream':251C 'user':82B,110B,163C,206C,211C,292C,315C,328C 'v234':20A,25A 'version':341C 'vladimir':350C 'vm':241C,265C,285C 'vulner':252C 'whose':243C 'without':109B,161C,291C 'written':60B,144C","nicknames":[],"mitigations":[],"who_affected":"Claude Desktop on macOS, versions from 1.1.3918 up to but not including 1.15962.0, is exposed when a user opens a file from a Cowork session's shared folder. The attack needs an agent inside the Cowork sandbox to place the file, which is what a compromised or prompt-injected agent would do. Teams using Claude Desktop with Cowork on Macs should check versions; Windows and Linux are not named in the advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Claude Desktop to version 1.15962.0 or later, since standard auto-update has already delivered this fix.","pkeys":["claudedesktop","desktop"],"ptokens":["claude","desktop"],"labels":["aiagents","aitooling","claudedesktop","cowork","cwe184","high","macos","other"],"campaign_type":null,"search_a":"'4jrq':21A,26A 'claud':1A 'claude':28A 'command':14A 'could':12A 'cowork':10A 'desktop':2A,29A 'file':7A 'folder':11A 'ghsa':19A,24A 'ghsa-v234-4jrq-mgg6':18A,23A 'host':17A 'maco':3A 'malici':6A 'mgg6':22A,27A 'open':4A 'run':13A 'v234':20A,25A","search_b":"'-184':41B '-2026':102B '-43284':103B 'advisori':89B 'agent':32B,73B 'ai':31B,34B 'ai-ag':30B 'ai-tool':33B 'also':90B 'block':46B 'chain':94B 'claud':37B,43B,86B 'claude-desktop':36B 'combin':93B 'command':76B 'compromis':68B 'could':74B,105B 'cowork':39B,63B 'cve':101B 'cwe':40B 'desktop':38B,44B,87B 'execut':54B 'file':50B,59B 'flaw':100B 'folder':65B 'guest':97B 'inject':72B 'interact':111B 'kernel':99B 'linux':98B 'list':47B 'mac':79B 'maco':42B,53B 'note':91B 'omit':48B 'open':56B,83B,108B 'prompt':71B 'prompt-inject':70B 'run':75B 'share':64B 'tool':35B 'trigger':106B 'type':51B 'user':82B,110B 'without':109B 'written':60B","search_c":"'-2026':254C '-43284':255C '1.11847.5':237C,258C '1.15962.0':220C,309C '2026':262C '9':260C 'add':221C 'advis':335C 'affect':248C 'agent':150C,200C 'alreadi':324C 'also':346C 'anthrop':345C 'auto':321C 'auto-upd':320C 'block':229C 'cannot':156C 'chang':314C 'claud':112C,216C,218C,232C,256C,307C,318C 'code':122C,277C 'combin':276C 'command':203C 'compromis':195C 'content':143C 'could':201C,286C 'cowork':135C,154C,191C,240C 'cve':253C 'cyera':352C 'desktop':113C,217C,219C,233C,257C,308C,319C 'direct':132C 'elev':281C 'ensur':141C 'execut':121C,157C,180C 'file':118C,174C,187C,214C,225C,289C,301C 'file-handl':300C 'fix':327C 'folder':139C,147C,192C 'gain':280C 'guest':244C 'handl':302C 'host':160C 'identifi':342C 'imag':242C,266C 'includ':312C 'independ':347C 'inject':199C 'insid':152C,283C 'intend':164C 'interact':293C 'intern':343C 'issu':274C,303C 'june':261C 'kernel':246C,270C 'later':311C 'latest':340C 'linux':245C 'list':116C,171C,230C 'mac':208C 'maco':169C 'maintain':114C 'manag':332C 'manual':330C 'omit':172C 'open':124C,131C,182C,212C,290C 'oper':178C 'patch':269C 'perform':329C 'place':188C 'prevent':126C 'prior':235C 'privileg':282C 'prompt':198C 'prompt-inject':197C 'rate':296C 'receiv':325C 'reflect':298C 'relat':224C 'releas':234C,259C 'report':348C 'research':353C 'result':185C 'run':151C,166C,202C 'sandbox':155C 'separ':231C 'session':136C 'sever':295C 'share':138C 'ship':238C 'standard':317C 'system':179C 'tokarev':351C 'trigger':287C 'two':273C 'type':119C,128C,175C,226C 'updat':263C,322C,333C,337C 'upstream':251C 'user':163C,206C,211C,292C,315C,328C 'version':341C 'vladimir':350C 'vm':241C,265C,285C 'vulner':252C 'whose':243C 'without':161C,291C 'written':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-25T21:54:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-v234-4jrq-mgg6","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6","severity":"high","published_at":"2026-09-25T21:54:09+00:00","modified_at":"2026-09-25T21:54:09+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","fetched_at":"2026-11-09T22:53:24+00:00","note":null}],"documents":[{"id":110601,"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}