Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-47091 Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidate… https://www.cve.org/CVERecord?id=CVE-2026-47091
Post summary
The CVE-2026-47091 CVE reports a path traversal flaw in Claude HUD 0.0.12 that has been patched via commit 234d9aa, with vulnerability details but no evidence of exploitation or PoC.
🚨*CVE* CVE-2026-47091 Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidate… https://www.cve.org/CVERecord?id=CVE-2026-47091 ----- Traducción: CVE-2026-47091 Cla… http://infoflow.cloud`
Post summary
The remark announces CVE-2026-47091, a path traversal flaw in Claude HUD 0.0.12, noting it permits arbitrary file reads and references the patch commit that fixes it.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jarrodwatts | claude_hud | - | claude_code | - |