CVE-2026-47092

CVE-2026-47092 : Claude HUD 0.0.12 contains a local command-injection via the COMSPEC environment variable. An attacker can set COMSPEC to an arbitrary binary path before Claude HUD performs its version check, causing execFile() to run the attacker-supplied executable with cmd.exe arguments, lead...