Description
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jarrodwatts claude-hud
Default version status: affected
0 to ≤ 0.0.12affected234d9aad919b51326a43bcf90b45ae35c23afc30unaffected
pkg:github/jarrodwatts/claude-hudReferences
- https://github.com/jarrodwatts/claude-hud/issues/485 ↗
- https://github.com/jarrodwatts/claude-hud/pull/487 ↗
- https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30 ↗
- https://www.vulncheck.com/advisories/claude-hud-arbitrary-command-execution-via-comspec-environment-variable ↗