CVE-2026-45136

HIGH EPSS 8.6%
Published May 27, 20261mo ago · Modified Jun 17, 20262w ago
8.6 CVSS 4.0
High
Find Similar
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.

CVSS Details

Base Score
8.6
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
8.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-78 OS Command Injection Injection
CWE-94 Improper Control of Generation of Code (Code Injection) Injection

Affected Products 1

VendorProductVersionRange
cnighswongerclaude-code-cache-fix*≥3.5.0  –  <3.5.2

References 3

  • github.com https://github.com/cnighswonger/claude-code-cache-fix/issues/108
    ExploitIssue Tracking
  • github.com https://github.com/cnighswonger/claude-code-cache-fix/pull/110
    Issue TrackingPatch
  • github.com https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g
    MitigationVendor Advisory

Remediation

  • github.com https://github.com/cnighswonger/claude-code-cache-fix/pull/110
    Issue TrackingPatch