Skip to content
Threat Feed

Product

Claude-Code-Cache-Fix

1 brief RSS
high advisory

claude-code-cache-fix Local Code Execution via Python Injection (CVE-2026-45136)

A vulnerability exists in claude-code-cache-fix versions 3.5.0 and 3.5.1 where the `tools/quota-statusline.sh` script interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal, allowing local code execution via Python triple-quote injection (CVE-2026-45136).

claude-code-cache-fix code-execution injection linux
2r 1t