Claude Desktop on Windows ran a git.exe found in the opened project directory (CVE-2026-88066, CVSS 4.0 7.5); fixed 1.8089.0, auto-updated

View raw markdownEdit on GitHub ↗

TL;DR

Anthropic published GHSA-4p2j-qj3c-6x84 on 2026-10-13: Claude Desktop on Windows before 1.8089.0 launched git.exe by bare name through uv_spawn, so the lookup could resolve a git.exe sitting in the current working directory before the system directories. A file of that name in a shared or cloned repository ran when the user opened the project. The advisory prints CVE-2026-88066, rates it High (CVSS 4.0 7.5), classes it as CWE-427 and says the fix shipped through standard auto-updates; manual installs need 1.8089.0 or later. Credit to Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W. It is the same bug Cursor had on Windows in July (CVE-2026-63093), now in the other major desktop agent, and the second Claude Desktop advisory this month after the Cowork folder-open command execution of 2026-09-25.

What happened

The advisory is on the anthropics/claude-code security tab, but the affected package it lists is Claude Desktop, affected < 1.8089.0, patched 1.8089.0. The text: on Windows, Claude Desktop launched git.exe using a bare executable name instead of an absolute path, "so the lookup could resolve to a git.exe located in the current working directory before system directories were searched." An attacker who could place a file in a project directory, "for example through a shared or cloned git repository," could have it executed when a user opened the project. Anthropic classes the result as remote code execution through supply-chain vectors.

The CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. UI:A means a user action is required, and the only action the description names is opening the project. AT:P reflects that the attacker needs a file in a folder the victim will open.

The CVE id is printed on the vendor page. CVE Services returned CVE_RECORD_DNE for CVE-2026-88066 on 2026-10-13, the same lag seen for Claude Code's TOCTOU write advisory on 2026-10-05 and the Plugin4Shell advisory on 2026-10-09. The id is the vendor's; the record will follow.

The class, again

Cursor's git.exe auto-execution (Mindgard, disclosed 2026-07-14, CVE-2026-63093) was the same shape: an agent that shells out to Git on project open, on Windows, with a search that reaches the workspace. That file's note that Cursor CLI, Gemini CLI and Codex were still unpatched for the equivalent in late July is the reason to read this advisory as a class marker rather than a one-off. Every desktop agent that runs git to show status, diff or history on open is a candidate, and the fix is the same each time: an absolute path, or a search that excludes the working directory.

The advisory's one-line remediation, "standard auto-updates have already delivered the fix," is also the one-line prevention: a Claude Desktop that cannot auto-update, because it is pinned, offline or managed, is the one that still has this.

Am I affected?

# Claude Desktop version (Windows): Help > About, or the installed package
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object DisplayName -like 'Claude*' | Select-Object DisplayName, DisplayVersion
# Below 1.8089.0 is affected.

# Did a project you opened carry a git.exe at its root? Only the working directory itself is on the search path,
# so check each project folder's top level, not its subtree (a nested fixture or bundled portable Git is not this bug).
# List every folder you opened in Claude Desktop while below 1.8089.0; the tool keeps no exportable history, so this list is yours to write.
$opened = @('C:\Users\you\source\repos\project-a', 'D:\work\project-b')
foreach ($root in $opened) {
  if (-not (Test-Path $root)) { Write-Warning "missing: $root"; continue }
  Get-ChildItem -Path $root -Filter git.exe -File -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
}
# An empty result is only as good as the list; then correlate each hit's write time with when you opened that project.

A git.exe at the root of a project folder you opened in an affected version is the artefact; a repository that committed one is the delivery. The time it was written against the time you opened the project decides whether it ran.

If you are affected

  1. Update to 1.8089.0 or later and confirm the version. If auto-update is disabled by policy, push the installer.
  2. If a git.exe sat at the root of a project folder you opened in a version below 1.8089.0, treat the machine as having run attacker code at your privilege: playbooks/if-your-local-ai-agent-was-exploited.md, then playbooks/rotating-cloud-credentials.md for everything the desktop session could reach, including the Claude session itself and any MCP server credentials in its config.
  3. Report the repository that carried the binary to its host.

Prevention

  • The folder you open in an agent is an install script for every tool that reads it on open: hooks, tasks, config and now a binary named like the tool the agent calls. Clone untrusted repositories into a sandboxed workspace first: prevention/agent-sandboxing.md.
  • Keep desktop agents on auto-update. This fix, like most of the vendor's tab, reached users before the advisory did.
  • Audit what your agent spawns by name. For a tool you maintain, resolve helper binaries to absolute paths and never search the working directory on Windows: prevention/supply-chain-attack-surface.md.

Sources