Claude Desktop on Windows runs malicious git.exe from project folder
Opening a project folder from someone else can hack your Windows PC.
Summary
Claude Desktop on Windows launches git.exe without an absolute path. A malicious git.exe placed in the project folder can then run in its place. Opening an attacker-controlled or shared repository can run the substituted program with the user's privileges.
Affected when
- Windows
- Opening an attacker-controlled or shared repository
What to do
Update Claude Desktop to 1.8089.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen