{"id":"CVE-2026-88066","published":"2026-11-03T20:18:18.850","lastModified":"2026-11-03T20:33:04.080","description":"Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-427"],"vendors":[],"products":[],"references":[{"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84","tags":[]}],"exploitRefs":[{"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84","tags":[]}],"hasPoc":true,"ai":null}