https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-47092.htmlhttps://patchthecve.com/cve/CVE-2026-47092.htmlMon, 26 Oct 2026 13:10:00 +0000HIGH 7.8: Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version chhttps://patchthecve.com/cve/CVE-2026-47091.htmlhttps://patchthecve.com/cve/CVE-2026-47091.htmlMon, 26 Oct 2026 13:10:00 +0000LOW 3.3: Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a pehttps://patchthecve.com/cve/CVE-2026-47090.htmlhttps://patchthecve.com/cve/CVE-2026-47090.htmlMon, 26 Oct 2026 13:10:00 +0000MEDIUM 4.6: Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embe