The vulnerability in claude-code-cache-fix (versions >=3.5.0 and <3.5.2) involves improper neutralization of special elements (CWE-78) and unsafe code injection (CWE-94) in the tools/quota-statusline.sh script. User input is directly embedded into a Python triple-quoted string without sanitization, enabling an attacker to inject a ''' sequence that closes the string early and allows execution of arbitrary Python code in the user's Claude Code process. This can lead to high-impact code execution with low attack complexity and no required privileges or user interaction. The vulnerability is resolved in version 3.5.2.

Successful exploitation allows an attacker to execute arbitrary Python code within the context of the user's Claude Code process, potentially leading to unauthorized actions or compromise of the affected system. The CVSS 4.0 score is 8.6 (high), reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no required privileges or user interaction.

This vulnerability is fixed in claude-code-cache-fix version 3.5.2. Users should upgrade to version 3.5.2 or later to remediate this issue. No official patch or temporary fix is documented beyond upgrading. Since the product is not a cloud service, remediation is the responsibility of the user. Patch status is not explicitly confirmed beyond the stated fix in 3.5.2; users should verify with the vendor for the latest advisory and updates.