CVE-2026-88066

Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uvspawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current workin...

CVE-2026-88066

Claude Desktop on Windows versions prior to 1.8089.0 is vulnerable to arbitrary code execution due to an uncontrolled search path issue. The application invokes git.exe using uv_spawn without specifying an absolute path, which allows Windows to resolve a malicious git.exe binary located in the cu...