# Claude Desktop on Windows: a planted git.exe ran when a project opened

> A malicious git.exe left in a shared repository ran on its own when Claude Desktop on Windows opened that folder.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** Anthropic
- **Disclosed:** 2026-10-13
- **CVE:** CVE-2026-88066
- **CVSS:** 7.5
- **Affects:** Claude Desktop
- **Research by:** Junhyuk Im (S2W), Jeongmin Choi (S2W), Seungyun Lee (S2W)
- **Primary source:** https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84
- **Page:** https://theinjection.dev/items/anthropic-claude-desktop-git-search-path-rce/

CVE-2026-88066 let a malicious git.exe placed in a project directory run automatically when a user opened that project in Claude Desktop on Windows. Anthropic fixed it in version 1.8089.0.

## What happened

Anthropic published GHSA-4p2j-qj3c-6x84 on October 13, 2026, assigning CVE-2026-88066 to an uncontrolled search path flaw in Claude Desktop on Windows. Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W reported it. The fix shipped in Claude Desktop 1.8089.0.

## How it works

Claude Desktop called uv_spawn to launch git.exe without giving an absolute path. Windows therefore searched the current working directory before the system directories, so a git.exe sitting in the open project folder won. Anthropic's advisory states that no interaction beyond opening the project was required, and classes the result as remote code execution reachable through supply chain vectors such as cloned repositories.

## Who is affected

Claude Desktop builds below 1.8089.0 are listed as affected, and the advisory describes the Windows build specifically. Anyone who opens a repository they did not write, for example a clone from a shared or public source, is in range.

## What to do

Update Claude Desktop to 1.8089.0 or later. Anthropic says machines on standard auto-update already have the fix, so the action falls to anyone who updates manually. Until you have updated, do not open untrusted repositories in Claude Desktop on Windows.

## Quick facts

- **Affected:** Claude Desktop on Windows before 1.8089.0
- **Fixed in:** 1.8089.0
- **CVE:** CVE-2026-88066
- **CVSS:** 7.5, CVSS v4.0, published by Anthropic
- **Found by:** Junhyuk Im, Jeongmin Choi and Seungyun Lee, S2W
- **Disclosed:** October 13, 2026
- **Attack type:** Uncontrolled search path element, CWE-427

## Questions

### Is Claude Desktop patched against CVE-2026-88066?

Claude Desktop 1.8089.0 contains the fix for CVE-2026-88066. Anthropic states that users on standard auto-update have already received it, and asks anyone who updates manually to move to at least 1.8089.0. Versions below 1.8089.0 remain affected on Windows, so check the installed build before opening repositories from sources you do not control.

### Does exploiting CVE-2026-88066 need me to click anything?

Opening the project directory in Claude Desktop is enough, according to Anthropic's advisory, which says no interaction beyond that was required. The planted git.exe runs when Claude Desktop next invokes git in that folder. Cloning a repository that carries a git.exe and then opening it is the realistic path to compromise on Windows.

### How is CVE-2026-88066 different from the Cowork file execution flaw?

CVE-2026-88066 is a search path problem in how Claude Desktop launches git.exe on Windows. GHSA-v234-4jrq-mgg6, published on September 25, 2026, covered Claude Desktop for macOS running commands when a user opened a malicious file from a Cowork folder. Different platforms, different triggers and separate fixes, so updating for one does not address the other.

### Which versions of Claude Desktop should I check for?

Any Claude Desktop build below 1.8089.0 is listed as affected in Anthropic's advisory, and 1.8089.0 is the patched release. Enterprise fleets that pin or repackage the desktop client should confirm the deployed build number rather than assume auto-update ran. Anthropic scored the flaw 7.5 on CVSS v4.0 and rated it high severity.

## Sources

1. [Anthropic Advisory](https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84)
2. [All Anthropic Advisories](https://github.com/anthropics/claude-code/security/advisories)