SB2026043028 - Untrusted search path in Claude Code

Description

This security bulletin contains information about 1 vulnerability.

1) Untrusted search path (CVE-ID: CVE-2026-35603)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to untrusted search path in system-wide configuration loading from C:\ProgramData\ClaudeCode\managed-settings.json when loading default configuration on Windows. A local user can create the ClaudeCode subdirectory and place a malicious configuration file to escalate privileges.

Exploitation requires a shared multi-user Windows system and a victim user to launch Claude Code after the malicious configuration is placed.

Remediation

Install update from vendor's website.

References

• https://github.com/anthropics/claude-code/security/advisories/GHSA-5cwg-9f6j-9jvx
• https://github.com/advisories/GHSA-5cwg-9f6j-9jvx