Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embed ESC+backslash sequences in the current working directory or branch URL to execute malicious ANSI codes including text color changes, forged prompts, and OSC 52 clipboard writes, or trigger outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-47090 Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping contro… https://www.cve.org/CVERecord?id=CVE-2026-47090
Post summary
The text reports CVE-2026-47090 as a flaw in Claude HUD involving malicious OSC 8 hyperlink escapes, and notes the vulnerability has been fixed in commit 234d9aa.
🚨*CVE* CVE-2026-47090 Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping contro… https://www.cve.org/CVERecord?id=CVE-2026-47090 ----- Traducción: CVE-2026-47090 Cla… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑47090 in Claude HUD, details the weakness involving OSC 8 hyperlinks, and notes that the issue was fixed in commit 234d9aa.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jarrodwatts | claude_hud | - | claude_code | - |