CVE-2026-35603: Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

CVE-2026-35603 · Severity: high · CVSS 7.3 · Published 2026-04-17

Claude Code is a terminal-based coding assistant developed by Anthropic. On Windows systems, it loaded configuration from a world-writable directory without permission checks, allowing an unprivileged local user to place a malicious configuration file that would be executed when any user on the system ran Claude Code. This could lead to unauthorized access to sensitive data, system modification, or system unavailability, but required shared multi-user access and user action to exploit.

Technologies: Anthropic Claude Code, Microsoft Windows, @anthropic-ai/claude-code (npm). Vendors: Anthropic, Microsoft, npm.

Quick answers

Is CVE-2026-35603 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35603 being exploited in the wild.
How severe is CVE-2026-35603?
High severity, with a CVSS score of 7.3, published 17 April 2026.
Which products and versions are affected?
Anthropic Claude Code all versions before 2.1.75; @anthropic-ai/claude-code (npm) < 2.1.75, SEMVER:introduced=0,fixed=2.1.75.
Is there a fix for CVE-2026-35603?
Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.75 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35603 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35603?
Check whether you run Anthropic Claude Code, Microsoft Windows or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @anthropic-ai/claude-code (npm): upgrade to 2.1.75 or later
    npm install @anthropic-ai/claude-code@2.1.75

Technical details

The vulnerability is an insecure search path issue (CWE-426) where Claude Code on Windows loaded system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or file permissions. Because Windows ProgramData is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created with restricted access, an unprivileged local user could create the directory and inject a malicious managed-settings.json file. Any user subsequently launching Claude Code on the same system would automatically load and execute this attacker-controlled configuration. The attack requires local system access, low privilege level, and user interaction (victim must launch Claude Code after the malicious file is placed). Impact is high: confidentiality, integrity, and availability of the victim's system could all be compromised. The fix is available in version 2.1.75 and later.

Affected products

  • Anthropic @anthropic-ai/claude-code all versions before 2.1.75

Identifiers

  • CVE-2026-35603
  • GHSA-5cwg-9f6j-9jvx

Timeline

  • 2026-04-17: disclosed
  • 2026-04-17: patched: Fix available in version 2.1.75

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.