What is CVE-2026-45136?

CVE-2026-45136 is a high-severity vulnerability in Cnighswonger Claude-code-cache-fix, classified under OS Command Injection. CVSS score: 7.8/10. Published 2026-05-27.

How severe is CVE-2026-45136?

High severity. CVSS v3 base score is 7.8 out of 10.

RCE in Cnighswonger Claude-code-cache-fix

CVE-2026-45136

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string lit…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.000 (4.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Cnighswonger Claude-code-cache-fix — versions >= 3.5.0, < 3.5.2

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
security-advisories@github.com (Exploit, x_refsource_MISC, Issue Tracking)
security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2026-45136?: CVE-2026-45136 is a high-severity vulnerability in Cnighswonger Claude-code-cache-fix, classified under OS Command Injection. CVSS score: 7.8/10. Published 2026-05-27.
How severe is CVE-2026-45136?: High severity. CVSS v3 base score is 7.8 out of 10.