CVE-2026-47091
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Claude HUD through version 0.0.12 contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. File metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.
Risk Assessment
An attacker can read any file readable by the process, including configurations, keys, or credentials, and the persistent cache may expose a history of accessed sensitive paths.
Recommendation
Immediately update Claude HUD to a version containing commit 234d9aa or later, and review cache file permissions; delete the cache if it contains sensitive paths.
Original NVD description (English source)
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.