Vulnerability Description
claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cnighswonger | Claude-Code-Cache-Fix | >= 3.5.0, < 3.5.2 |
Related Weaknesses (CWE)
References
- https://github.com/cnighswonger/claude-code-cache-fix/issues/108ExploitIssue Tracking
- https://github.com/cnighswonger/claude-code-cache-fix/pull/110Issue TrackingPatch
- https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-gMitigationVendor Advisory
- https://github.com/cnighswonger/claude-code-cache-fix/issues/108ExploitIssue Tracking
- https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-gMitigationVendor Advisory
FAQ
What is CVE-2026-45136?
CVE-2026-45136 is a vulnerability with a CVSS score of 7.8 (HIGH). claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly...
How severe is CVE-2026-45136?
CVE-2026-45136 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45136?
Check the references section above for vendor advisories and patch information. Affected products include: Cnighswonger Claude-Code-Cache-Fix.