An uncontrolled search path element in Claude-hud enables arbitrary command execution, posing a critical security risk to the host system.

The vulnerability (CWE-427) stems from an uncontrolled search path element, allowing attackers to hijack execution flows by manipulating environment variables like COMSPEC. The attack requires local access and specific environmental conditions to achieve arbitrary command execution.

The CVSS score of 7.8 (High) indicates a significant risk to system integrity and availability. An attacker successfully exploiting this vulnerability could execute commands with the privileges of the affected application, potentially leading to a full system compromise.

Immediate Action: Update the jarrodwatts/claude-hud package to the version containing commit 234d9aad919b51326a43bcf90b45ae35c23afc30.

Proactive Monitoring: Audit environment variable configurations in environments where the software is deployed to ensure they are not susceptible to path hijacking.

Compensating Controls: Restrict the ability of non-privileged users to modify environment variables that could impact the execution path of critical applications.

Public Exploit Available: Unknown

This vulnerability represents a significant risk of command execution. Organizations should prioritize updating to the fixed version identified in the vendor's repository to eliminate the path hijacking vector and harden the application against local exploitation.