CVE-2026-88066

HighCVSS 7.5/10Last modified Nov 9, 2026

Description

Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.

Metrics

CVSS 4.0 7.5/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-427

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 3, 2026
Last modified
Nov 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-880699.3Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image,CVE-2026-880707.8Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.CVE-2026-880717.8Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-880727.8Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.CVE-2026-880737.8Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-880747.8Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges loCVE-2026-880758.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorizedCVE-2026-880767.0Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-880778.8Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-880784.3Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing overCVE-2026-880797.0Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.CVE-2026-880807.8Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-88066: High severity, CVSS 7.5 | Vulnix