jarrodwatts claude-hud up to 0.0.12 on Windows Environment Variable execFile uncontrolled search path

Summaryinfo

A vulnerability identified as problematic has been detected in jarrodwatts claude-hud up to 0.0.12 on Windows. The affected element is the function execFile of the component Environment Variable Handler. This manipulation causes uncontrolled search path. This vulnerability appears as CVE-2026-47092. The attack requires local access. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability has been found in jarrodwatts claude-hud up to 0.0.12 on Windows and classified as problematic. Affected by this vulnerability is the function execFile of the component Environment Variable Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.

The weakness was presented by Katriel Moses as 485. The advisory is shared at github.com. This vulnerability is known as CVE-2026-47092 since 05/18/2026. The exploitation appears to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Applying the patch 234d9aad919b51326a43bcf90b45ae35c23afc30 is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• jarrodwatts

Name

• claude-hud

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12

License

• open-source

Website

• Product: https://github.com/jarrodwatts/claude-hud/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion