PT-2026-116396
CVE-2026-88066
·
Published
2026-10-17
·
Updated
2026-10-17
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Claude Desktop versions prior to 1.8089.0
Description
Opening a software project in the application could trigger the execution of malicious code. The issue occurs because the application invokes
git.exe by name rather than specifying the full path to a trusted executable. This allows Windows to potentially locate and execute a malicious file named git.exe placed within the opened project directory instead of the legitimate Git program. An attacker can exploit this by placing a malicious executable inside a repository that a user opens.Recommendations
Update Claude Desktop to version 1.8089.0.
Found an issue in the description? Have something to add? Feel free to write us 👾