Claude Code / Claude Desktop's own GHSA index: 8 more advisories (Feb–Jun 2026) this repo hadn't tracked

View raw markdownEdit on GitHub ↗

TL;DR

A direct audit of github.com/anthropics/claude-code/security/advisories — the same "walk the vendor's own GHSA index" discipline this repo applied to Cursor on 2026-07-18 — turned up 8 patched CVEs from February–June 2026 that had not surfaced in this repo's prior aggregator-focused sweeps, on top of the already-tracked InversePrompt cluster. All are fixed and most ship automatically via Claude Code's auto-update, but two (CVE-2026-44470, CVE-2026-44467) affect Claude Desktop for Windows specifically and require a manual update if auto-update is disabled.

What happened

Anthropic discloses Claude Code and Claude Desktop vulnerabilities primarily through its own GitHub Security Advisories, and — as with Cursor's advisory page in a prior sweep — several entries here had not been picked up by search-engine-driven queries, likely because they lack independent aggregator coverage. All seven CVE↔GHSA pairings below were confirmed by fetching the advisory page directly; the two highest-severity were cross-confirmed against NVD.

CVE-2026-55607 (GHSA-7835-87q9-rgvv) — Sandbox escape via git worktree path confusion, CVSS 8.8/7.7, published 2026-06-25

Claude Code's worktree handling allowed creating a worktree literally named .git, enabling git-directory confusion. Combined with path traversal in worktree navigation, symlink manipulation, and abuse of git's fsmonitor hook execution during worktree operations, a malicious repository containing prompt-injection content could get Claude Code to overwrite files in the user's home directory (e.g., .zshenv) and execute code outside the seatbelt sandbox. Affected: >= 2.1.38, < 2.1.163. Patched: 2.1.163.

CVE-2026-54316 (GHSA-fg94-h982-f3mm) — Out-of-band exfiltration via pre-approved HuggingFace domain in WebFetch, CVSS 6.0, published 2026-06-13

huggingface.co was pre-approved as a bare hostname for the WebFetch tool, so any path on that domain was auto-fetched with no permission prompt and no --allowedTools gating. An attacker able to inject untrusted content into Claude's context could direct WebFetch at attacker-controlled HuggingFace repository files (e.g., a resolve/main/config.json path) and use HuggingFace's own download-counting mechanism as a covert side channel to exfiltrate file contents, environment variables, or command output — no outbound connection to an unfamiliar domain required, the same "allowlisted host as camouflage" shape this repo has tracked for AI-vendor-host exfil, just applied to an allowlisted third-party domain instead. Affected: >= 0.2.54, < 2.1.163. Patched: 2.1.163. Reported via HackerOne (novee).

CVE-2026-44470 (GHSA-5p5x-5294-qhp3) — CoworkVMService directory-junction LPE, CVSS 8.5/7.8, published 2026-05-06

On Windows, CoworkVMService runs as SYSTEM and creates files inside the Cowork VM bundle directory without checking whether that path is a real directory or an NTFS directory junction. A local, non-elevated user can replace the user-writable bundle directory with a junction pointing anywhere on disk; the SYSTEM-privileged service then creates SYSTEM-owned files at the attacker's chosen location — full local privilege escalation. Affected: Claude Desktop for Windows < 1.3834.0. Patched: 1.3834.0. Independently confirmed via NVD. Note: this is a distinct, already-patched CoworkVMService bug, separate from the unresolved Armadin DLL-sideloading/RPC-abuse chain already tracked in Claude Cowork for Windows sandbox escape — same component, two unrelated root causes.

CVE-2026-44467 (GHSA-3rwf-2g6p-c2f9) — SSH host key verification bypass enables MITM, CVSS 7.8/7.4, published 2026-05-06

Claude Desktop's SSH remote-development feature checked only whether a hostname existed in ~/.ssh/known_hosts, without comparing the presented host key against the stored one. A network-positioned attacker (rogue Wi-Fi, ARP/DNS spoofing) who intercepts a connection to an already-known host can present any host key and have it silently accepted, letting them read and modify traffic in a full MITM. Affected: >= 1.2581.0, < 1.4304.0. Patched: 1.4304.0.

CVE-2026-46406 (GHSA-4vp2-6q8c-pvq2) — Insecure temp file in /copy command, CVSS 6.1, published 2026-06-25

The /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) with no UID isolation, randomness, or symlink protection — world-readable (0644) in a world-traversable directory (0755), letting any local user read a privileged user's Claude output (which may contain secrets), and letting a local attacker pre-plant a symlink at that path to redirect the privileged write to an arbitrary file. Affected: >= 2.1.59, < 2.1.128. Patched: 2.1.128.

CVE-2026-40068 (GHSA-q5hj-mxqh-vv77) — Trust dialog bypass via git worktree spoofing, CVSS 7.7, published 2026-04-24

Folder-trust determination read the git worktree commondir file without validating its contents. A crafted repository's commondir pointing at a path the victim had previously trusted let Claude Code skip the trust-confirmation dialog entirely and immediately execute hooks defined in .claude/settings.json — arbitrary command execution with no prompt shown, provided the attacker can guess or learn a path the victim already trusts. Affected: >= 2.1.63, < 2.1.84. Patched: 2.1.84.

CVE-2026-35020 (GHSA-jgg3-qqhf-7rx7) — OS command injection via TERMINAL environment variable, published 2026 (Claude Code CLI and Claude Agent SDK)

Claude Code CLI and the Claude Agent SDK for Python built a shell command incorporating the TERMINAL environment variable without sanitizing shell metacharacters, executable via normal CLI usage or the deep-link handler, running arbitrary commands under the invoking user's privileges. Affected: Claude Code <= 2.1.91, Claude Agent SDK for Python <= 0.1.55. Patched: Claude Code 2.1.92, Claude Agent SDK 0.1.56.

CVE-2026-25722 (GHSA-66q4-vfjg-2qhh) — Command injection via directory change bypasses write protection, CVSS 7.7, published 2026-02-06

Claude Code's write-protection guardrail (which blocks unapproved writes to sensitive directories like .claude/) didn't properly re-validate the working directory after a cd command changed it — an attacker able to get untrusted content into the context window could have the agent cd into a protected directory and then write/modify files there without triggering the approval check. Combines CWE-20 (improper input validation) and CWE-78 (OS command injection). Affected: < 2.0.57. Patched: 2.0.57. Reported via HackerOne (nil221) — one of this repo's earliest-dated finds in this batch, predating even the April 2026 CVEs above by two months, and found via this sweep's index walk rather than any prior aggregator query.

Update (2026-08-06): added this eighth entry, found on a follow-up pass of Cursor's and Claude Code's own GHSA indexes in the same sweep — two other candidate GHSA IDs found in that pass (GHSA-5cwg-9f6j-9jvx / CVE-2026-35603, GHSA-mmgp-wc2j-qcv7 / CVE-2026-33068) turned out to already be listed (without full write-ups) in the InversePrompt cluster advisory's CVE roster — confirmed via direct grep before treating them as new, per this repo's standing "verify the actual IOC/CVE list, don't trust a prior summary" discipline.

All eight are distinct from the CVEs already listed in this repo's Claude Code InversePrompt cluster (CVE-2025-54794, CVE-2025-54795, CVE-2025-52882, CVE-2025-59536, CVE-2026-21852, CVE-2026-33068, CVE-2026-24887, CVE-2026-35021, CVE-2026-39861, CVE-2026-35603, CVE-2026-25723) and the git.exe / DuneSlide-class findings tracked elsewhere in this repo.

Am I affected?

# Check your Claude Code CLI version
claude --version

# Fixes for all eight land at or before 2.1.163 — anything below that on a manual-update install is exposed to at least one
# Claude Agent SDK for Python — check for TERMINAL-injection fix
pip show claude-agent-sdk 2>/dev/null | grep -i version   # need >= 0.1.56

# Claude Desktop for Windows — CoworkVMService LPE and SSH MITM require >= 1.3834.0 and >= 1.4304.0 respectively
# Help > About Claude in the desktop app

Users on Claude Code's standard auto-update have already received all eight fixes; this advisory matters mainly for pinned/manual-update installs, CI images that bake in a specific Claude Code version, and Claude Desktop for Windows users who've disabled auto-update.

If you are affected

→ playbooks/if-your-local-ai-agent-was-exploited.md → playbooks/rotating-cloud-credentials.md — if you ran an affected version against an untrusted repo or over an untrusted network path

Prevention

→ prevention/agent-sandboxing.md → prevention/supply-chain-attack-surface.md — treat cloned repos as untrusted input; don't assume "sandboxed" covers every escape route

  • Pin CI/CD images to the latest Claude Code release, not a version frozen at build time — as this repo has noted before, "latest" carries undisclosed and disclosed security fixes alike.
  • Don't disable auto-update on Claude Desktop unless you have a process for checking github.com/anthropics/claude-code/security/advisories directly — this sweep's own finding is that these advisories under-surface in general security news coverage.

Why this matters for vibe coders

This is the same lesson the Cursor GHSA index audit produced: a vendor's own GitHub Security Advisories index is a primary source that general security-news queries routinely miss, especially for CVEs that never get an independent researcher writeup or aggregator pickup. Seven fixed, unremarkable-looking advisories accumulate into a real gap in any tracker (including this one) that leans on search-engine discovery. If you maintain your own AI-tool inventory, add a periodic direct check of each tool's own advisory page — github.com/<org>/<repo>/security/advisories — to your process rather than relying solely on news aggregators or CVE feeds, which lag or skip vendor-only disclosures.

Update 2026-09-26 — a new Claude Desktop advisory on the tab (published 2026-09-25): on macOS, Cowork's blocklist of "file types that execute when opened" missed one the OS runs automatically, so an agent in the Cowork sandbox could stage a file that ran commands on the host when the user opened it; a Cowork VM kernel bug made a no-interaction variant possible before June

GHSA-v234-4jrq-mgg6 — High, CVSS 4.0 8.5, no CVE, affected Claude Desktop ≥ 1.1.3918 and < 1.15962.0, fixed 1.15962.0. The design: Cowork sessions run the agent in a VM and share a folder with the host; to stop the agent from using that folder to run code on the Mac, Claude Desktop keeps a blocklist of file types that execute when opened. On macOS the list "was incomplete and omitted a file type that the operating system executes automatically upon opening," so "a malicious or prompt-injected agent could place such a file in a Cowork folder, and if the user opened it from Claude Desktop, the file would execute commands on the user's Mac." The advisory also discloses that Claude Desktop before 1.11847.5 (released 2026-06-09) shipped a Cowork VM image whose guest Linux kernel was affected by CVE-2026-43284 (an in-kernel ESP/xfrm bug, NVD 2026-05-08); combined with the file-handling gap, "code with elevated privileges inside the VM could trigger file execution without user interaction." Found internally by Anthropic and independently reported by Vladimir Tokarev (Cyera Research). Auto-updating installs already have both fixes; managed or manual installs need ≥ 1.15962.0.

This is the third Cowork host-boundary advisory in the corpus after the July sandbox escape and SharedRoot, and it follows the same shape as the batch above: the vendor advisory is the only record (no CVE, no blog, no press at sweep time), it appeared on the tab a day before any listing carried it, and the affected range spans months. Status of this file stays patched.

Update 2026-09-30 — a Low advisory on the tab (published 2026-09-29) that enterprise admins should read anyway: Claude Code 2.0.68 – 2.1.259 preferred a locally stored API key over the user's Enterprise/Team sign-in when fetching server-managed settings, so a rejected key meant the session ran with no organisation policy, or a stale cached one (CVE-2026-103012, CVSS 2.0, fixed 2.1.260)

GHSA-gfvf-j8jh-jxxw / CVE-2026-103012 (Anthropic CNA, published 2026-09-29, Low, CVSS 4.0 2.0, CWE-696, credit Tamas Voros / NVIDIA AI Red Team). When fetching an organisation's server-managed settings, Claude Code "selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in." If the settings endpoint rejected that key, the session "started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account." Triggering it needs local access to a device that holds such a stored key; the no-policy case additionally needs no cached settings. MDM- and file-managed settings are unaffected. Affected ≥ 2.0.68 < 2.1.260 for Enterprise (from 2.0.68) and Team (from 2.1.38); fixed 2.1.260; auto-updaters already have it, npm's current line is 2.1.285 (2026-09-29). The score is low because the precondition is a local actor with a key on the box — but the failure mode is exactly the one enterprise controls exist to prevent (deny rules silently absent), and a developer who once ran /login with a personal key is the "local actor." Check for stray keys in the config directory on managed fleets.

GHSA-5j29-h97v-84ch / CVE-2026-103435 (vendor advisory, published 2026-10-05, High, CVSS 4.0 7.7 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H, CWE-22 / CWE-61 / CWE-367, credit hackerone.com/c_h4ck_0). The advisory: Claude Code "validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox." Affected < 2.1.129, fixed 2.1.129. The prerequisites are the ones the vector encodes: write access to the shared workspace (a co-tenant on a shared dev box, a container with a mounted repo, a lower-privileged CI step) and winning a race against the write, with the payoff that "a lower-privileged attacker" redirects "benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session." It is the fourth symlink-shaped Claude Code advisory in this corpus after CVE-2025-59829, CVE-2026-25724 and CVE-2026-39861 — the earlier three were deny-rule and sandbox-boundary bypasses the agent could be prompt-injected into; this one needs a second principal on the filesystem, which is why it is not a prompt-injection story.

Two record-keeping notes. The GHSA page prints the CVE id, but CVE Services returned CVE_RECORD_DNE for CVE-2026-103435 on 2026-10-05 — Anthropic (the CNA) had not pushed the record when the tab published, so NVD and the database mirrors will lag; grep the GHSA until then. And 2.1.129 was released well before 2.1.260 (the fix for the managed-settings bug above), so anyone on auto-update has had this fix for some time; the advisory is a disclosure, not a new patch. Status stays patched.

Update 2026-10-07 — the CVE-2026-103435 record now exists: Anthropic (CNA) published it at CVE Services on 2026-10-07, two days after the GHSA page printed the id

The 2026-10-05 note above recorded CVE_RECORD_DNE for CVE-2026-103435. Re-queried 2026-10-07: the record is PUBLISHED, assignerShortName: Anthropic, datePublished 2026-10-07T12:50Z (reserved 2026-09-30), title "Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code," affected @anthropic-ai/claude-code < 2.1.129, CVSS 4.0 7.7 with the same vector as the vendor page, single reference GHSA-5j29-h97v-84ch. The description matches the GHSA verbatim; nothing else changed. NVD and the database mirrors will follow. Open item closed; status unchanged (patched). The tab was re-walked the same day: still the three September/October entries (GHSA-v234-4jrq-mgg6 09-25, GHSA-gfvf-j8jh-jxxw / CVE-2026-103012 09-29, GHSA-5j29-h97v-84ch 10-05) — nothing new.

Update 2026-10-26 — a High advisory published today: a time-of-check gap in the Edit tool let a process already inside the Bash sandbox on macOS redirect an edit to a file outside the project (CVE-2026-88968, CVSS 7.7, fixed 2.1.251)

GHSA-5xjx-9qx6-jcrv (published 2026-10-26, High, CVSS 4.0 7.7, CWE-59 and CWE-367): on macOS, code running in Claude Code's Bash sandbox could race the Edit tool's path check against its write, so a benign edit landed on a file the sandbox was meant to keep out of reach. Affected @anthropic-ai/claude-code below 2.1.251; the fix shipped in 2.1.251 on 2026-08-28, so any install updated since then is covered; the current release on 10-26 is 2.1.311. Credit Sunder Singh (mahoraga007). It is the same check-then-use class as the 2026-10-05 entry above, reached from the other side: there a workspace-local attacker, here code the agent itself ran in the sandbox.

Update 2026-11-10: the CVE-2026-88968 record exists (GitHub CNA, 2026-11-03) and the database row is dated 2026-11-09; nothing new to patch

The Edit-tool time-of-check advisory this file recorded on 2026-10-26 (GHSA-5xjx-9qx6-jcrv) now has a CVE Services record, published by the GitHub CNA on 2026-11-03 20:08 UTC: "Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor", on macOS, with "attacker-controlled code running in the Bash sandbox" as the precondition; CVSS 4.0 7.7 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H), the same score the vendor page printed. The advisory database's claude listing shows the row as published 2026-11-09, which is the database date, not a disclosure. The fix is still 2.1.251 (npm 2026-08-28). On 2026-11-10 npm latest is 2.1.322 and stable is 2.1.311, both after the fix.

Sources