# CVE-2026-88066: Anthropic Claude Desktop arbitrary code execution via uncontrolled search path

Source: https://junglewise.ai/threats/cve-2026-88066-claude-desktop-is-anthropic-s-desktop-application-for-interacting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-88066 · Severity: info · Published 2026-11-03

Claude Desktop, a desktop application for interacting with the AI assistant Claude, on Windows versions prior to 1.8089.0 executes Git commands without specifying the full path to the executable. An attacker can place a malicious git.exe in a project directory (such as a shared Git repository) that is executed automatically when a user opens that directory, bypassing any explicit warnings. This allows remote code execution with the privileges of the user opening the repository, making it a supply-chain attack vector for compromised or attacker-controlled repositories.

Technologies: [Anthropic Claude Desktop](https://junglewise.ai/threats/technologies/claude-desktop). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic).

## Quick answers

**Is CVE-2026-88066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88066 being exploited in the wild.

**How severe is CVE-2026-88066?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Anthropic Claude Desktop before 1.8089.0.

**Is there a fix for CVE-2026-88066?** Yes: fixed in 1.8089.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88066 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88066?** Check whether you run Anthropic Claude Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.8089.0

## Technical details

Claude Desktop on Windows uses uv_spawn to execute git.exe without an absolute path, allowing Windows to resolve the executable by searching the current working directory before system directories. An attacker places a malicious git.exe in a project folder; when the user opens that directory in Claude Desktop, the malicious executable is invoked automatically without user interaction beyond opening the project. This is a network-exploitable code execution vulnerability with active user interaction required (opening a project) and no privilege escalation needed.

## Affected products

- Anthropic Claude Desktop before 1.8089.0

## Timeline

- 2026-10-13: disclosed
- 2026-10-13: advisory: GitHub Security Advisory GHSA-4p2j-qj3c-6x84
- 2026-10-13: patched: Version 1.8089.0 released; auto-update users already protected
- 2026-11-03: other: CVE-2026-88066 published to NVD

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84](https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84)

## Related threats

- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Desktop Cowork missing integrity check in VM image handling](https://junglewise.ai/threats/cve-2026-7574-anthropic-claude-desktop-cowork-missing-integrity-check-in-vm)
- [Anthropic Claude Desktop privilege escalation in CoworkVMService](https://junglewise.ai/threats/cve-2026-44470-anthropic-claude-desktop-privilege-escalation-in-coworkvmservice)
- [Anthropic Claude Desktop SSH host key verification bypass](https://junglewise.ai/threats/cve-2026-44467-anthropic-claude-desktop-ssh-host-key-verification-bypass)
- [Anthropic Claude for Windows privilege escalation in installer](https://junglewise.ai/threats/cve-2026-22561-anthropic-claude-for-windows-privilege-escalation-in-installer)