Is CVE-2026-47092 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47092 being exploited in the wild.

How severe is CVE-2026-47092?

High severity, with a CVSS score of 7.8, published 18 May 2026.

Which products and versions are affected?

Jarrodwatts Claude HUD through 0.0.12.

Is there a fix for CVE-2026-47092?

A patch was published on 2026-04-22: Fix merged in commit 234d9aa. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47092 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-47092?

Check whether you run Jarrodwatts Claude HUD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47092: jarrodwatts Claude HUD command injection via COMSPEC environment variable

CVE-2026-47092 · Severity: high · CVSS 7.8 · Published 2026-05-18

Claude HUD, a terminal-based dashboard for Claude Code, is vulnerable to a security flaw on Windows systems that allows a local attacker to take control of the application. By manipulating a specific system setting (the COMSPEC environment variable) before the application starts, an attacker can trick the software into running a malicious program instead of the standard Windows command processor. This could lead to full system compromise or unauthorized data access on the user's computer.

Technologies: Jarrodwatts Claude HUD. Vendors: Jarrodwatts.

Quick answers

Is CVE-2026-47092 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47092 being exploited in the wild.
How severe is CVE-2026-47092?: High severity, with a CVSS score of 7.8, published 18 May 2026.
Which products and versions are affected?: Jarrodwatts Claude HUD through 0.0.12.
Is there a fix for CVE-2026-47092?: A patch was published on 2026-04-22: Fix merged in commit 234d9aa. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47092 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-47092?: Check whether you run Jarrodwatts Claude HUD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in Claude HUD through version 0.0.12 within the version check component (`src/version.ts`). On Windows systems, the application retrieves the `COMSPEC` environment variable and passes it directly as the executable argument to `execFile()` without validation. A local attacker or a malicious process (such as a compromised npm script) can set `COMSPEC` to point to an arbitrary binary. When Claude HUD performs its periodic version check, it executes the attacker-controlled binary with `cmd.exe` arguments, leading to arbitrary code execution. This has been patched in commit 234d9aa by hardcoding the path to the system's legitimate `cmd.exe`.

Affected products

jarrodwatts Claude HUD through 0.0.12

Timeline

2026-04-19: disclosed: Vulnerability reported to maintainer by Katriel Moses.
2026-04-22: patched: Fix merged in commit 234d9aa.
2026-05-18: advisory: CVE-2026-47092 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.