CVE-2026-88066: Claude Desktop: untrusted search path runs rogue git.exe

HIGH

Published November 3, 2026

CISO Take

Claude Desktop on Windows, before version 1.8089.0, launches git.exe without an absolute path, so Windows can pick up a malicious git.exe sitting in the opened project's working directory (CWE-427, uncontrolled search path). Opening an attacker-controlled or shared repository is enough to run arbitrary code with the user's privileges, which on developer workstations often means access to source code, cloud credentials and signing keys. Exploitation likelihood is unquantified: no EPSS score, no public exploit, no Nuclei template and no KEV listing exist yet, but the technique is trivial to reproduce once the advisory is public. No downstream dependents are tracked, so exposure is limited to endpoints with the desktop app, though the package has 25 other CVEs, which points to a recurring security debt. Upgrade Claude Desktop to 1.8089.0 or later on all Windows endpoints and treat untrusted repositories as hostile until the fleet is patched.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High severity, though no CVSS vector, EPSS or SSVC data is available, so exploitability is estimated from the description. The attack needs the user to open a malicious or shared project folder (user interaction), but complexity is low: the attacker only has to plant a file named git.exe in the repository. Impact is code execution at user privilege, which can lead to credential theft, source code exposure and lateral movement. There is no evidence of active exploitation, KEV listing or public exploit as of 2026-11-04. Confidence: MEDIUM, because the severity score is from the source and the vector details are inferred.

How does the attack unfold?

Initial Access

Attacker delivers a repository or archive containing a malicious git.exe in its root directory.

AML.T0011

Execution

Victim opens the project in Claude Desktop, which calls git without an absolute path and Windows runs the planted binary.

AML.T0112.000

Credential Access

The payload runs with user privileges and harvests tokens, SSH keys and cloud credentials from the workstation.

Impact

Attacker gains a persistent foothold and can reach source code and connected services.

Initial Access

Attacker delivers a repository or archive containing a malicious git.exe in its root directory.

AML.T0011

Execution

Victim opens the project in Claude Desktop, which calls git without an absolute path and Windows runs the planted binary.

AML.T0112.000

Credential Access

The payload runs with user privileges and harvests tokens, SSH keys and cloud credentials from the workstation.

Impact

Attacker gains a persistent foothold and can reach source code and connected services.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Claude Code	npm	—	No patch
154.1KPushed 4d ago59% patched~5d to patchFull package profile →

Do you use Claude Code? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Update Claude Desktop to 1.8089.0 or later on all Windows hosts and confirm the version through your endpoint management tooling. 2) Until patched, avoid opening untrusted or third-party repositories in Claude Desktop, and inspect them for unexpected git.exe, or other .exe/.bat/.cmd files in the project root before opening. 3) Detection: alert on process creation events where git.exe runs from a path other than the standard Git for Windows install directory, especially with Claude Desktop as the parent process. 4) Apply application allowlisting (WDAC or AppLocker) to block execution of binaries from user-writable project directories. 5) Rotate credentials on any workstation where a suspicious git.exe is found executing.

How is it classified?

Code ExecutionSupply ChainAgentPluginAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-88066?

Is CVE-2026-88066 actively exploited?

No confirmed active exploitation of CVE-2026-88066 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-88066?

1) Update Claude Desktop to 1.8089.0 or later on all Windows hosts and confirm the version through your endpoint management tooling. 2) Until patched, avoid opening untrusted or third-party repositories in Claude Desktop, and inspect them for unexpected git.exe, or other .exe/.bat/.cmd files in the project root before opening. 3) Detection: alert on process creation events where git.exe runs from a path other than the standard Git for Windows install directory, especially with Claude Desktop as the parent process. 4) Apply application allowlisting (WDAC or AppLocker) to block execution of binaries from user-writable project directories. 5) Rotate credentials on any workstation where a suspicious git.exe is found executing.

What systems are affected by CVE-2026-88066?

This vulnerability affects the following AI/ML architecture patterns: AI desktop assistants, Developer workstations, Agent frameworks, AI-assisted coding tools.

What is the CVSS score for CVE-2026-88066?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

AI desktop assistantsDeveloper workstationsAgent frameworksAI-assisted coding tools

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.

Exploitation Scenario

An attacker publishes a repository, or sends a zip of a project, that contains a crafted git.exe in its root folder alongside plausible source code. A developer on Windows opens the folder in Claude Desktop to get AI help reviewing it. The app calls git without an absolute path, Windows resolves the name to the current working directory first, and the attacker's binary runs with the developer's privileges. The payload steals browser sessions, cloud and SSH credentials and the Claude session tokens, then establishes a persistent foothold on the workstation.

Weaknesses (CWE)

CWE-427Uncontrolled Search Path Element

CWE-427 — Uncontrolled Search Path Element: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.