---
id: 2026-10-claude-desktop-windows-git-exe-search-path-rce-cve-2026-88066
title: "Claude Desktop on Windows ran a git.exe found in the opened project directory (CVE-2026-88066, CVSS 4.0 7.5); fixed 1.8089.0, auto-updated"
date_disclosed: 2026-10-13
last_updated: 2026-10-13
severity: high
status: patched
ecosystems: [claude-code, claude-desktop, windows, ai-ide]
tools_affected: ["Claude Desktop for Windows before 1.8089.0", "any shared, cloned or synced project folder a Windows user opens in Claude Desktop"]
tags: [cve, ghsa, claude-desktop, windows, search-path, git-hijacking, zero-click-rce, workspace-open-execution, auto-update, patched]
---

## TL;DR
Anthropic published GHSA-4p2j-qj3c-6x84 on 2026-10-13: Claude Desktop on Windows before 1.8089.0 launched `git.exe` by bare name through `uv_spawn`, so the lookup could resolve a `git.exe` sitting in the current working directory before the system directories. A file of that name in a shared or cloned repository ran when the user opened the project. The advisory prints CVE-2026-88066, rates it High (CVSS 4.0 7.5), classes it as CWE-427 and says the fix shipped through standard auto-updates; manual installs need 1.8089.0 or later. Credit to Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W. It is the same bug Cursor had on Windows in July (CVE-2026-63093), now in the other major desktop agent, and the second Claude Desktop advisory this month after the Cowork folder-open command execution of 2026-09-25.

## What happened

The advisory is on the `anthropics/claude-code` security tab, but the affected package it lists is Claude Desktop, affected `< 1.8089.0`, patched 1.8089.0. The text: on Windows, Claude Desktop launched `git.exe` using a bare executable name instead of an absolute path, "so the lookup could resolve to a `git.exe` located in the current working directory before system directories were searched." An attacker who could place a file in a project directory, "for example through a shared or cloned git repository," could have it executed when a user opened the project. Anthropic classes the result as remote code execution through supply-chain vectors.

The CVSS 4.0 vector is `AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`. `UI:A` means a user action is required, and the only action the description names is opening the project. `AT:P` reflects that the attacker needs a file in a folder the victim will open.

The CVE id is printed on the vendor page. CVE Services returned `CVE_RECORD_DNE` for CVE-2026-88066 on 2026-10-13, the same lag seen for [Claude Code's TOCTOU write advisory](2026-08-claude-code-desktop-ghsa-batch.md) on 2026-10-05 and the [Plugin4Shell advisory](2026-09-plugin4shell-sha-pin-bypass-coding-agent-plugins.md) on 2026-10-09. The id is the vendor's; the record will follow.

### The class, again

[Cursor's `git.exe` auto-execution](2026-07-cursor-git-exe-autoexec.md) (Mindgard, disclosed 2026-07-14, CVE-2026-63093) was the same shape: an agent that shells out to Git on project open, on Windows, with a search that reaches the workspace. That file's note that Cursor CLI, Gemini CLI and Codex were still unpatched for the equivalent in late July is the reason to read this advisory as a class marker rather than a one-off. Every desktop agent that runs `git` to show status, diff or history on open is a candidate, and the fix is the same each time: an absolute path, or a search that excludes the working directory.

The advisory's one-line remediation, "standard auto-updates have already delivered the fix," is also the one-line prevention: a Claude Desktop that cannot auto-update, because it is pinned, offline or managed, is the one that still has this.

## Am I affected?

```powershell
# Claude Desktop version (Windows): Help > About, or the installed package
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object DisplayName -like 'Claude*' | Select-Object DisplayName, DisplayVersion
# Below 1.8089.0 is affected.

# Did a project you opened carry a git.exe at its root? Only the working directory itself is on the search path,
# so check each project folder's top level, not its subtree (a nested fixture or bundled portable Git is not this bug).
# List every folder you opened in Claude Desktop while below 1.8089.0; the tool keeps no exportable history, so this list is yours to write.
$opened = @('C:\Users\you\source\repos\project-a', 'D:\work\project-b')
foreach ($root in $opened) {
  if (-not (Test-Path $root)) { Write-Warning "missing: $root"; continue }
  Get-ChildItem -Path $root -Filter git.exe -File -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
}
# An empty result is only as good as the list; then correlate each hit's write time with when you opened that project.
```

A `git.exe` at the root of a project folder you opened in an affected version is the artefact; a repository that committed one is the delivery. The time it was written against the time you opened the project decides whether it ran.

## If you are affected

1. **Update to 1.8089.0 or later** and confirm the version. If auto-update is disabled by policy, push the installer.
2. **If a `git.exe` sat at the root of a project folder you opened in a version below 1.8089.0**, treat the machine as having run attacker code at your privilege: [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md), then [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md) for everything the desktop session could reach, including the Claude session itself and any MCP server credentials in its config.
3. **Report the repository** that carried the binary to its host.

## Prevention

- **The folder you open in an agent is an install script** for every tool that reads it on open: hooks, tasks, config and now a binary named like the tool the agent calls. Clone untrusted repositories into a sandboxed workspace first: [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md).
- **Keep desktop agents on auto-update.** This fix, like most of the vendor's tab, reached users before the advisory did.
- **Audit what your agent spawns by name.** For a tool you maintain, resolve helper binaries to absolute paths and never search the working directory on Windows: [prevention/supply-chain-attack-surface.md](../prevention/supply-chain-attack-surface.md).

## Sources
- [Anthropic — GHSA-4p2j-qj3c-6x84: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable](https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84) — fetched 2026-10-13: published 2026-10-13 by ddworken, package Claude Desktop, affected `< 1.8089.0`, patched 1.8089.0, CVE-2026-88066, High, CVSS 4.0 7.5 with the vector above, CWE-427, the `uv_spawn` and working-directory mechanism, the auto-update remediation, credit to Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W. Single source: the vendor advisory; no outlet or database listing carried it on the sweep date.
- [anthropics/claude-code security advisories](https://github.com/anthropics/claude-code/security/advisories) — fetched 2026-10-13: the row dated Oct 13, 2026, beside the 2026-10-09 plugin SHA-pin bypass, the 2026-10-05 TOCTOU write and the 2026-09-25 Cowork folder-open advisory.
- CVE Services, queried 2026-10-13 for CVE-2026-88066: `CVE_RECORD_DNE`, no record yet, so no link; re-check on the next sweep.
- Related in this corpus: [Cursor IDE git.exe auto-execution on Windows](2026-07-cursor-git-exe-autoexec.md) (CVE-2026-63093, the same class), [Claude Code and Desktop GHSA batch](2026-08-claude-code-desktop-ghsa-batch.md), [Plugin4Shell](2026-09-plugin4shell-sha-pin-bypass-coding-agent-plugins.md).