Claude Desktop on Windows Ran git.exe From the Project Folder - CVE-2026-88066
On October 13, 2026, Anthropic published GHSA-4p2j-qj3c-6x84, assigned CVE-2026-88066: Claude Desktop on Windows launched Git by its bare name, and Windows found a git.exe in the project folder before it found the real one. Open a repository that carries such a file and it runs. CVSS 4.0 7.5, High, CWE-427, fixed in Claude Desktop 1.8089.0, credited to Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W.
There is no prompt injection here, no tool the model chose to call and no permission the user granted. The bug is in how the host process starts a helper, and it is older than AI: CWE-427 has been in the catalog for years, and Windows search order has bitten installers and IDEs before. What makes it matter now is the thing the host is attached to. A coding agent is pointed at repositories its user did not write, by design, all day.
What to do now
- Confirm every Windows Claude Desktop install is on 1.8089.0 or later. Auto-updating installs already are. The ones to find are machines where auto-update is disabled by policy, blocked by a proxy, or quietly failing.
- Hunt once for
git.exeat repository roots on developer machines and build agents. It is an unusual file to find there and cheap to look for. - Treat the three October advisories as one floor: Claude Code 2.1.129 for CVE-2026-103435, 2.1.179 for CVE-2026-86063, and Claude Desktop 1.8089.0 for this one.
- Do not rely on the agent permission model for this class. The execution happens before any tool call, so
PreToolUsehooks, allow lists and sandbox settings never see it.
How the bug works
- Claude Desktop used
uv_spawnto rungit.exewithout an absolute path. - On Windows, resolving a bare executable name for a new process checks the current working directory before the system directories.
- An attacker places a malicious
git.exein a project directory, for example by committing it to a repository the target will clone or by sharing a folder. - The target opens that directory in Claude Desktop. The app spawns Git, Windows resolves the name to the attacker's file, and it runs with the user's privileges.
The CVSS vector (AV:N/AC:L/AT:P/PR:N/UI:A) records the shape: network-reachable through the repository, low complexity, one precondition (the file has to be in the folder), no privileges, and one active user interaction, which is opening the project. The advisory lists no workaround. The fix is to resolve the Git binary to an absolute path, and 1.8089.0 does that.
The repository as attack surface, third time this autumn
This is the third distinct way a repository on disk has become code execution in a Claude product since September. GitSpawn poisoned .git/config so that Git itself launched a helper when an agent ran git status. Plugin4Shell named a branch like a commit so that a pinned plugin checkout landed on attacker code. CVE-2026-88066 does not need Git to misbehave at all: the host resolved the wrong binary before Git ran. Three different fixes, one precondition in common, and one shared property: none of them is a tool call the agent could have asked permission for. The Claude Code harness attack surface is wider than the model's decisions, and the pieces that run before the model gets a say are the ones a permission policy cannot reach.
The same month also brought a symlink race in Claude Code's write path, reported October 5 and fixed in 2.1.129. Put together, Anthropic has shipped three High advisories for its coding agent and desktop host in nine days. That is the research community doing its job on software that sits between untrusted repositories and developer credentials, and it will continue. The practical consequence for a security team is that agent host versions are now patch-managed software with a floor, like browsers, and the floor moved three times this month.
How Anomity surfaces and governs it
See it. The Anomity Endpoint Sensor inventories the AI tools on every managed Windows, macOS and Linux machine, with versions, so the Windows installs still below Claude Desktop 1.8089.0 are a query, and the same query answers the next advisory. A fleet deployment of Claude Code that updates normally is covered; the sensor finds the machines that do not. Metadata only; secrets are redacted on the endpoint.
Enforce where there is a hook. On Claude Code, Anomity decides allow, deny or log at the PreToolUse hook before a tool call runs. We say plainly that this control does not cover CVE-2026-88066: the process starts before any tool call exists. That is the reason to pair runtime governance with version hygiene rather than choosing one. Keep the record. Version changes and policy decisions land in a 90-day audit trail and route to SIEM, Slack, email or Jira. Anomity is SOC 2 Type II and complements EDR, DLP, network and GRC tooling; it does not replace them.
If you cannot say today how many Windows machines run Claude Desktop, let alone which version, that is the gap to close before the next advisory. Book a 30-minute demo and we will show you the inventory for your own fleet.
Frequently asked questions
Am I affected by CVE-2026-88066?
If you run Claude Desktop on Windows and the version is older than 1.8089.0, yes. macOS is not named in the advisory; the search-order behaviour that makes this exploitable is a Windows process-creation rule. Anthropic says standard auto-update has already delivered the fix, so the exposure concentrates on installs where auto-update is disabled, blocked by policy, or failing silently.
How does the attack work?
Claude Desktop spawned Git by the bare name git.exe instead of an absolute path such as C:\Program Files\Git\cmd\git.exe. When Windows resolves a bare executable name for a new process it looks in the current working directory before the system directories. A repository that contains a file called git.exe at its root therefore supplies the Git binary the app runs. Opening that project in Claude Desktop is the only user action required. The advisory classifies it as remote code execution reachable through supply-chain vectors such as cloned repositories.
Is this the same bug as GitSpawn?
No, but it rhymes. GitSpawn abused what Git itself does with a poisoned .git/config, for example a core.fsmonitor helper, when an agent runs git status or git diff. CVE-2026-88066 never reaches the real Git: the agent host resolved the wrong binary before any Git code ran. Both share the precondition that a repository you did not write is on disk and a Claude product is pointed at it, and both execute outside the agent's own permission model, which is why neither shows up as a tool call you could have declined.
What is the right fleet response?
Confirm every Windows Claude Desktop install is on 1.8089.0 or later, and find the ones that are not. Those are usually machines where auto-update is off or the app was installed by hand. A hunt for git.exe files at repository roots on developer machines is cheap and worth running once. Longer term, treat agent host versions as patch-managed software with a floor, the same way you treat browsers.
Why do these keep landing in October?
Anthropic published three High-severity advisories for Claude Code and Claude Desktop in nine days: a symlink race on October 5 (CVE-2026-103435, fixed in Claude Code 2.1.129), the plugin pin bypass on October 9 (CVE-2026-86063, fixed in 2.1.179) and this one on October 13. Coding agents sit on the boundary between untrusted repositories and a developer's credentials, and that boundary is getting the research attention it deserves. Expect more.
How does Anomity help with this?
The Anomity Endpoint Sensor inventories the AI tools installed on every managed machine with their versions, so the Windows machines still below Claude Desktop 1.8089.0 are a query rather than a survey, and the same query answers the next advisory. On Claude Code, Anomity decides allow, deny or log at the PreToolUse hook before a tool call runs. That control does not cover a process the host spawns before any tool call, which is exactly why version floors matter. Findings land in a 90-day audit trail and route to SIEM, Slack, email or Jira.
