CVE-2026-47090: Claude HUD XSS Vulnerability

CVE-2026-47090 Overview

CVE-2026-47090 is a terminal injection vulnerability in Claude HUD through version 0.0.12. The flaw exists in how the application constructs Operating System Command (OSC) 8 terminal hyperlink escape sequences. Claude HUD embeds raw cwd (current working directory) and branchUrl values into escape sequences without stripping control characters or encoding embedded values. Attackers can inject arbitrary American National Standards Institute (ANSI) escape codes into terminal sessions through these unsanitized fields. The issue is tracked under [CWE-150] and was patched in commit 234d9aa.

Critical Impact
Attackers can inject ANSI codes that change text color, forge prompts, write to the clipboard via OSC 52, or trigger outbound HTTP requests to attacker-controlled hosts when crafted hyperlinks are clicked.

Affected Products

Claude HUD through version 0.0.12
Fixed in commit 234d9aa
Distributed via the jarrodwatts/claude-hud GitHub repository

Discovery Timeline

2026-05-18 - CVE-2026-47090 published to the National Vulnerability Database (NVD)
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-47090

Vulnerability Analysis

Claude HUD is a terminal heads-up display utility that renders contextual information such as the current working directory and active Git branch. To make these elements clickable inside modern terminal emulators, the application wraps them in OSC 8 hyperlink escape sequences. An OSC 8 sequence has the form ESC ] 8 ; params ; URI ST, where ST (string terminator) is either ESC \ or the BEL character.

The vulnerability stems from concatenating attacker-controllable cwd and branchUrl strings directly into the escape sequence template. Claude HUD does not strip control bytes such as ESC (0x1B) or the BEL terminator, nor does it percent-encode the URI portion. An attacker who controls a directory name or a Git branch URL can embed an ESC \ sequence to close the hyperlink prematurely and inject additional ANSI or OSC payloads.

Downstream effects include forged shell prompts, manipulated terminal colors, OSC 52 clipboard writes that exfiltrate or overwrite the user's clipboard, and arbitrary outbound HTTP requests when a victim clicks the rendered hyperlink. Refer to the VulnCheck Security Advisory for additional analysis.

Root Cause

The root cause is improper neutralization of escape sequences in output ([CWE-150]). Claude HUD treats cwd and branchUrl as trusted plain text and inserts them into terminal control sequences without sanitization or encoding.

Attack Vector

Exploitation requires local interaction. An attacker stages a malicious repository, branch name, or directory path. When a victim navigates Claude HUD into that context, the malicious bytes are rendered to the terminal. Clicking the resulting hyperlink can trigger outbound network activity to an attacker-controlled host. See the GitHub Issue Report for proof-of-concept context.

No verified exploit code is published. The vulnerability mechanism is documented in the patch commit and pull request rather than as a standalone exploit. See the GitHub Pull Request for the remediation diff.

Detection Methods for CVE-2026-47090

Indicators of Compromise

Directory names or Git branch names containing raw ESC (0x1B), BEL (0x07), or ESC \ byte sequences.
Terminal session logs showing unexpected OSC 8, OSC 52, or Select Graphic Rendition (SGR) sequences originating from Claude HUD output.
Outbound HTTP or HTTPS connections from a developer workstation to unfamiliar hosts immediately after interaction with Claude HUD hyperlinks.

Detection Strategies

Scan local repositories and working directories for filenames or branch names containing control characters using grep -P "[\\x00-\\x1F\\x7F]".
Inspect Claude HUD output streams or recorded terminal sessions (script, asciinema) for OSC 52 (ESC ] 52) clipboard write sequences, which legitimate use of Claude HUD does not emit.
Correlate developer endpoint process telemetry with DNS and HTTP egress logs to identify clicked hyperlinks resolving to non-corporate hosts.

Monitoring Recommendations

Monitor endpoint detection and response (EDR) telemetry on developer workstations for Claude HUD child processes spawning network clients or clipboard utilities.
Enable shell history and audit logging on workstations running Claude HUD so injected prompt forgeries can be reconstructed during incident review.
Track installed versions of claude-hud across the developer fleet to confirm all instances are at or beyond commit 234d9aa.

How to Mitigate CVE-2026-47090

Immediate Actions Required

Upgrade Claude HUD to a release that includes commit 234d9aa or later.
Audit any cloned repositories, branch names, and working directories for embedded control characters before opening them in Claude HUD.
Treat untrusted repositories as hostile and review branch metadata before checking them out on developer machines.

Patch Information

The maintainer fixed the issue in commit 234d9aa by sanitizing cwd and branchUrl values before they are embedded in OSC 8 escape sequences. Review the GitHub Commit Record and the merged GitHub Pull Request for the exact remediation logic.

Workarounds

Disable or uninstall Claude HUD until the patched version is deployed.
Configure terminal emulators to ignore OSC 52 clipboard writes and to prompt before opening hyperlinks.
Restrict use of Claude HUD to trusted repositories whose branch and path metadata are controlled internally.

bash

# Configuration example: confirm Claude HUD is updated past the patched commit
npm ls claude-hud
npm install claude-hud@latest

# Detect control characters in branch names within a repository
git for-each-ref --format='%(refname:short)' refs/heads/ \
  | grep -P "[\\x00-\\x1F\\x7F]" && echo "Suspicious branch names detected"