PT-2026-41730 · Unknown · Claude-Hud

Katriel Moses · Published 2026-05-18 · Updated 2026-05-20 · CVE-2026-47090

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Claude HUD versions 0.0.0 through 0.0.12

Description The software constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values. This allows attackers to inject arbitrary ANSI codes into terminal sessions by embedding ESC+backslash sequences in the current working directory or branch URL. Potential impacts include text color changes, forged prompts, OSC 52 clipboard writes, or triggering outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked.

Recommendations Update to the version containing commit 234d9aa. As a temporary workaround, avoid using directories or branch URLs containing control characters in the cwd and branchUrl variables.

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-47090

Affected Products

Claude-Hud

References · 8

• https://github.com/jarrodwatts/claude-hud/pull/487 · Patch
• https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47090 · Security Note
• https://github.com/jarrodwatts/claude-hud/issues/485 · Note
• https://twitter.com/CVEnew/status/2056994230879617369 · Twitter Post
• https://vulncheck.com/advisories/claude-hud-terminal-injection-via-osc-8-hyperlinks · Note
• https://twitter.com/infoflowcloud/status/2056994921886650553 · Twitter Post
• https://t.me/CVEtracker/54167 · Telegram Post