CVE-2026-88066

Name of the Vulnerable Software and Affected Versions Claude Desktop versions prior to 1.8089.0

Description Opening a software project in the application could trigger the execution of malicious code. The issue occurs because the application invokes git.exe by name rather than specifying the full path to a trusted executable. This allows Windows to potentially locate and execute a malicious file named git.exe placed within the opened project directory instead of the legitimate Git program. An attacker can exploit this by placing a malicious executable inside a repository that a user opens.

Recommendations Update Claude Desktop to version 1.8089.0.