{"id":"CVE-2026-45136","aliases":["GHSA-g3xq-3gmv-qq8g"],"url":"https://o3.security/vulnerability/CVE-2026-45136","summary":"claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh","details":"claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.","published":"2026-05-27T20:48:22.312Z","modified":"2026-07-15T01:49:21.784263893Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"claude-code-cache-fix","fixedVersion":"3.5.2"}],"fix":{"url":"https://github.com/cnighswonger/claude-code-cache-fix/pull/110","label":"cnighswonger/claude-code-cache-fix#110"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45136.json"},{"type":"ADVISORY","url":"https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45136"},{"type":"REPORT","url":"https://github.com/cnighswonger/claude-code-cache-fix/issues/108"},{"type":"FIX","url":"https://github.com/cnighswonger/claude-code-cache-fix/pull/110"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:21.784263893Z"}}