SB2026043028 - Untrusted search path in Claude Code

Description

This security bulletin contains information about 1 security vulnerability.

1) Untrusted search path (CVE-ID: CVE-2026-35603)

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to untrusted search path in system-wide configuration loading from C:\ProgramData\ClaudeCode\managed-settings.json when loading default configuration on Windows. A local user can create the ClaudeCode subdirectory and place a malicious configuration file to escalate privileges.

Exploitation requires a shared multi-user Windows system and a victim user to launch Claude Code after the malicious configuration is placed.

Remediation

Install update from vendor's website.

References

• https://github.com/anthropics/claude-code/security/advisories/GHSA-5cwg-9f6j-9jvx
• https://github.com/advisories/GHSA-5cwg-9f6j-9jvx