CVE-2026-47091

MEDIUM EPSS 2.6%
Published May 18, 20261mo ago · Modified Jun 17, 20261w ago
4.8 CVSS 4.0
Medium
Find Similar
Published May 18, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.

CVSS Details

Base Score
4.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
2.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
jarrodwattsclaude_hud* ≤0.0.12

References 4

  • github.com https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30
    Patch
  • github.com https://github.com/jarrodwatts/claude-hud/issues/485
    Issue Tracking
  • github.com https://github.com/jarrodwatts/claude-hud/pull/487
    Issue TrackingPatch
  • vulncheck.com https://www.vulncheck.com/advisories/claude-hud-path-traversal-via-transcript-path
    Third Party Advisory

Remediation

  • github.com https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30
    Patch
  • github.com https://github.com/jarrodwatts/claude-hud/pull/487
    Issue TrackingPatch