The vulnerability arises from an insecure handling of the COMSPEC environment variable. When claude-hud performs a version check, it spawns a child process via execFile. If COMSPEC has been set to an arbitrary path, the spawned process will execute that binary with cmd.exe arguments. This enables a local attacker to run any command with the privileges of the claude-hud process, effectively achieving arbitrary command execution. The weakness is a form of insecure environment variable usage (CWE-427).

The affected product is the open‑source Claude HUD project hosted by jarrodwatts. Versions up to and including 0.0.12 are vulnerable. The issue exists only on Windows platforms where the COMSPEC variable is available. The bug was fixed in commit 234d9aa, which removes the reliance on COMSPEC during the startup routine. Only installations of 0.0.12 or earlier that have not applied the patch remain at risk.

The CVSS base score for this vulnerability is 7.3, indicating a high severity. No EPSS data is publicly available, and the vulnerability is not listed in CISA’s KEV catalog, but it can be exploited by any local user with read/write access to the system where claude-hud runs. Because the flaw involves environment variable manipulation, an attacker needs nothing beyond setting COMSPEC before the application launches. Prompt remediation is strongly recommended.