Is Claude Desktop patched against CVE-2026-88066?

Claude Desktop 1.8089.0 contains the fix for CVE-2026-88066. Anthropic states that users on standard auto-update have already received it, and asks anyone who updates manually to move to at least 1.8089.0. Versions below 1.8089.0 remain affected on Windows, so check the installed build before opening repositories from sources you do not control.

Does exploiting CVE-2026-88066 need me to click anything?

Opening the project directory in Claude Desktop is enough, according to Anthropic's advisory, which says no interaction beyond that was required. The planted git.exe runs when Claude Desktop next invokes git in that folder. Cloning a repository that carries a git.exe and then opening it is the realistic path to compromise on Windows.

How is CVE-2026-88066 different from the Cowork file execution flaw?

CVE-2026-88066 is a search path problem in how Claude Desktop launches git.exe on Windows. GHSA-v234-4jrq-mgg6, published on September 25, 2026, covered Claude Desktop for macOS running commands when a user opened a malicious file from a Cowork folder. Different platforms, different triggers and separate fixes, so updating for one does not address the other.

Which versions of Claude Desktop should I check for?

Any Claude Desktop build below 1.8089.0 is listed as affected in Anthropic's advisory, and 1.8089.0 is the patched release. Enterprise fleets that pin or repackage the desktop client should confirm the deployed build number rather than assume auto-update ran. Anthropic scored the flaw 7.5 on CVSS v4.0 and rated it high severity.

HIGHVulnerability

Claude Desktop on Windows: a planted git.exe ran when a project opened

A malicious git.exe left in a shared repository ran on its own when Claude Desktop on Windows opened that folder.

October 13, 2026 · Anthropic · Research by Junhyuk Im (S2W), Jeongmin Choi (S2W), Seungyun Lee (S2W)

CVE-2026-88066

HIGHVulnerability

CVE-2026-88066 let a malicious git.exe placed in a project directory run automatically when a user opened that project in Claude Desktop on Windows. Anthropic fixed it in version 1.8089.0.

01What happened

Anthropic published GHSA-4p2j-qj3c-6x84 on October 13, 2026, assigning CVE-2026-88066 to an uncontrolled search path flaw in Claude Desktop on Windows. Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W reported it. The fix shipped in Claude Desktop 1.8089.0.

02How it works

Claude Desktop called uv_spawn to launch git.exe without giving an absolute path. Windows therefore searched the current working directory before the system directories, so a git.exe sitting in the open project folder won. Anthropic's advisory states that no interaction beyond opening the project was required, and classes the result as remote code execution reachable through supply chain vectors such as cloned repositories.

03Who is affected

Claude Desktop builds below 1.8089.0 are listed as affected, and the advisory describes the Windows build specifically. Anyone who opens a repository they did not write, for example a clone from a shared or public source, is in range.

04What to do

Update Claude Desktop to 1.8089.0 or later. Anthropic says machines on standard auto-update already have the fix, so the action falls to anyone who updates manually. Until you have updated, do not open untrusted repositories in Claude Desktop on Windows.

Questions people ask

Is Claude Desktop patched against CVE-2026-88066?: Claude Desktop 1.8089.0 contains the fix for CVE-2026-88066. Anthropic states that users on standard auto-update have already received it, and asks anyone who updates manually to move to at least 1.8089.0. Versions below 1.8089.0 remain affected on Windows, so check the installed build before opening repositories from sources you do not control.
Does exploiting CVE-2026-88066 need me to click anything?: Opening the project directory in Claude Desktop is enough, according to Anthropic's advisory, which says no interaction beyond that was required. The planted git.exe runs when Claude Desktop next invokes git in that folder. Cloning a repository that carries a git.exe and then opening it is the realistic path to compromise on Windows.
How is CVE-2026-88066 different from the Cowork file execution flaw?: CVE-2026-88066 is a search path problem in how Claude Desktop launches git.exe on Windows. GHSA-v234-4jrq-mgg6, published on September 25, 2026, covered Claude Desktop for macOS running commands when a user opened a malicious file from a Cowork folder. Different platforms, different triggers and separate fixes, so updating for one does not address the other.
Which versions of Claude Desktop should I check for?: Any Claude Desktop build below 1.8089.0 is listed as affected in Anthropic's advisory, and 1.8089.0 is the patched release. Enterprise fleets that pin or repackage the desktop client should confirm the deployed build number rather than assume auto-update ran. Anthropic scored the flaw 7.5 on CVSS v4.0 and rated it high severity.

Sources 2 links, all fetched

1github.comAnthropic Advisory
2github.comAll Anthropic Advisories