Description
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jarrodwatts claude-hud
Default version status: affected
0 to ≤ 0.0.12affected234d9aad919b51326a43bcf90b45ae35c23afc30unaffected
pkg:github/jarrodwatts/claude-hud