CVE-2026-88066: Claude Desktop on Windows ran a malicious git.exe from the project folder

Vulnerability · Claude Desktop · HIGH

Incident dateNot stated

DisclosedOct 13, 2026 (Anthropic advisory GHSA-4p2j-qj3c-6x84, CVE-2026-88066). NVD record still pending.

Added hereOct 14, 7:35 AM ET

Last verifiedOct 14, 2026

Summary

Anthropic published advisory GHSA-4p2j-qj3c-6x84 for Claude Desktop on Windows, assigned CVE-2026-88066. The app started git.exe without an absolute path, so Windows looked in the current working directory before the system directories. A git.exe placed in a project folder, for example inside a shared or cloned repository, ran as soon as the user opened that folder in Claude Desktop. Version 1.8089.0 fixes it, and Anthropic says users on standard auto-update already have the fix. The NVD record for CVE-2026-88066 is still pending.

Severity

HIGH Code execution on a Windows machine from opening a project folder, with no other interaction. Anthropic scores it CVSS 4.0 7.5 High. Fixed in 1.8089.0.

Timeline

Oct 13, 2026
Anthropic publishes GHSA-4p2j-qj3c-6x84: versions before 1.8089.0 affected, fixed in 1.8089.0. The advisory lists CVE-2026-88066. The NVD record is still pending.

How it happened

Claude Desktop used uv_spawn to run git.exe by name only. On Windows that search includes the current working directory first, which here was the project the user opened. Anyone who could get a file named git.exe into a repository could have it run in place of the real git. Anthropic classifies it as CWE-427 (Uncontrolled Search Path Element) and describes it as remote code execution through supply-chain vectors such as cloned repositories. Anthropic credits Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W with the report. We cite Anthropic's advisory for the CVE ID; the NVD page for CVE-2026-88066 is not populated yet.

How to check your app

Make sure Claude Desktop on Windows is on 1.8089.0 or later, especially if you update it manually.
Before opening a cloned repository, look for .exe files in its root (git.exe in particular) that have no reason to be there.
Treat any repository you did not write as untrusted until you have looked at what it contains.

Sources

Anthropic advisory GHSA-4p2j-qj3c-6x84 (CVE-2026-88066)

Corrections and updates

Oct 14, 2026
Added CVE-2026-88066. Our first version said no CVE was listed; Anthropic's advisory lists CVE-2026-88066 (assigned after publication). The NVD record is still pending.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.