CVE-2026-47091 is a path traversal vulnerability in the jarrodwatts claude-hud project affecting versions through 0.0.12. The flaw arises from improper validation of the transcript_path parameter supplied via stdin JSON, enabling attackers with low privileges to read arbitrary files accessible by the process. Additionally, the metadata of these files is stored in a cache file with weak permissions, creating a persistent forensic record. Although a patch exists (commit 234d9aa), no formal vendor advisory or patch distribution details are provided. The CVSS 4.0 base score is 4.8, reflecting medium severity with local attack vector and low complexity.

An attacker with limited privileges can exploit this vulnerability to read any file accessible by the claude-hud process, potentially exposing sensitive information. The creation of a persistent cache file containing metadata of accessed files with insufficient permissions may also lead to unintended information disclosure or forensic analysis risks. There is no indication of remote exploitation or privilege escalation. No known exploits are reported in the wild.

A patch addressing this vulnerability was committed (commit 234d9aa), but no official vendor advisory or patch distribution details are available. Users should update to the fixed version incorporating this commit as soon as possible. Until patched, restrict access to the claude-hud process and carefully control input sources to prevent untrusted transcript_path values. Monitor for updates from the vendor or project repository for official remediation guidance. Patch status is not yet confirmed by a vendor advisory — check the project repository for the latest updates.