The Pulse
Claude Desktop Flaw Ran Malicious Git Executables in Repositories
Anthropic disclosed a Windows flaw that could run an attacker’s Git executable when a user opened a project in Claude Desktop. Version 1.8089.0 fixes the vulnerability, which the advisory rates High with a CVSS v4 score of 7.5.
AI.info Team · Written with AI ·
Anthropic disclosed on October 13 that Claude Desktop for Windows could run a malicious Git executable planted inside a project directory. Opening the project was enough to trigger the flaw; users did not need to approve a command or take another action after opening it. Anthropic fixed the vulnerability in Claude Desktop version 1.8089.0.
Windows searched the project folder first
The problem began when Claude Desktop launched Git using uv_spawn without specifying the executable’s absolute path. On Windows, that allowed the app to search the current working directory before system directories for a file named git.exe. A project directory containing an attacker’s replacement executable could therefore supply the program Claude Desktop ran.
Anthropic described the issue as remote code execution that could be exploited through supply-chain routes, including cloned repositories. The flaw did not require a user to approve a command or take a separate action, but exploitation did require the user to open the affected project in Claude Desktop. The advisory characterizes that as active user interaction in its CVSS metrics.
That distinction limits what the advisory claims: the flaw was not described as an attack on every Windows computer with Claude Desktop installed. The risk arose when a user opened a project containing the malicious executable. The advisory says the executable would then run automatically.
Version 1.8089.0 contains the fix
The advisory lists Claude Desktop versions earlier than 1.8089.0 as affected and names 1.8089.0 as the patched release. Anthropic rated the issue High and assigned it a CVSS v4 score of 7.5 out of 10. Its listed metrics include network attack vector, low attack complexity, no privileges required and high potential impact on confidentiality, integrity and availability of the vulnerable system.
The advisory identifies the vulnerability as CVE-2026-88066 and lists its weakness as CWE-427, an uncontrolled search path element. The report credits Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W with reporting the flaw.
Anthropic says users on its standard Claude Desktop auto-update have received the fix already. Users who update manually are advised to install the latest version; the advisory identifies 1.8089.0 as the patched release. Administrators who manage desktop deployments can check which version is installed, particularly on Windows machines used to open repositories from outside their organization.
A repository can carry more than source code
The flaw made opening a downloaded project the point at which an attacker-controlled executable could run. The attack did not depend on Claude following malicious instructions or making a bad judgment. It exploited how the desktop app located Git on Windows, allowing a file in the project directory to take precedence over the system executable.
Anthropic’s stated fix is version 1.8089.0. Until a manually updated installation reaches that version, users can avoid opening repositories they do not trust in Claude Desktop on Windows. The advisory’s description specifically identifies a shared Git repository as one way an attacker could place the malicious executable in a project.