# CVE-2026-47092: jarrodwatts Claude HUD command injection via COMSPEC environment variable

Source: https://junglewise.ai/threats/cve-2026-47092-jarrodwatts-claude-hud-command-injection-via-comspec-environment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-47092 · Severity: high · CVSS 7.8 · Published 2026-05-18

Claude HUD, a terminal-based dashboard for Claude Code, is vulnerable to a security flaw on Windows systems that allows a local attacker to take control of the application. By manipulating a specific system setting (the COMSPEC environment variable) before the application starts, an attacker can trick the software into running a malicious program instead of the standard Windows command processor. This could lead to full system compromise or unauthorized data access on the user's computer.

Technologies: [Jarrodwatts Claude HUD](https://junglewise.ai/threats/technologies/claude-hud). Vendors: [Jarrodwatts](https://junglewise.ai/threats/vendors/jarrodwatts).

## Quick answers

**Is CVE-2026-47092 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47092 being exploited in the wild.

**How severe is CVE-2026-47092?** High severity, with a CVSS score of 7.8, published 18 May 2026.

**Which products and versions are affected?** Jarrodwatts Claude HUD through 0.0.12.

**Is there a fix for CVE-2026-47092?** A patch was published on 2026-04-22: Fix merged in commit 234d9aa. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47092 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-47092?** Check whether you run Jarrodwatts Claude HUD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in Claude HUD through version 0.0.12 within the version check component (`src/version.ts`). On Windows systems, the application retrieves the `COMSPEC` environment variable and passes it directly as the executable argument to `execFile()` without validation. A local attacker or a malicious process (such as a compromised npm script) can set `COMSPEC` to point to an arbitrary binary. When Claude HUD performs its periodic version check, it executes the attacker-controlled binary with `cmd.exe` arguments, leading to arbitrary code execution. This has been patched in commit 234d9aa by hardcoding the path to the system's legitimate `cmd.exe`.

## Affected products

- jarrodwatts Claude HUD through 0.0.12

## Timeline

- 2026-04-19: disclosed: Vulnerability reported to maintainer by Katriel Moses.
- 2026-04-22: patched: Fix merged in commit 234d9aa.
- 2026-05-18: advisory: CVE-2026-47092 published.

## References

- [https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30](https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30)
- [https://github.com/jarrodwatts/claude-hud/issues/485](https://github.com/jarrodwatts/claude-hud/issues/485)
- [https://github.com/jarrodwatts/claude-hud/pull/487](https://github.com/jarrodwatts/claude-hud/pull/487)
- [https://www.vulncheck.com/advisories/claude-hud-arbitrary-command-execution-via-comspec-environment-variable](https://www.vulncheck.com/advisories/claude-hud-arbitrary-command-execution-via-comspec-environment-variable)

## Related threats

- [jarrodwatts Claude HUD path traversal in transcript_path](https://junglewise.ai/threats/cve-2026-47091-jarrodwatts-claude-hud-path-traversal-in-transcript-path)
- [Claude HUD terminal injection in OSC 8 hyperlinks](https://junglewise.ai/threats/cve-2026-47090-claude-hud-terminal-injection-in-osc-8-hyperlinks)