CVE-2026-35603 Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows
A local attacker can escalate privileges by placing a malicious configuration file in a writable system directory, which is then loaded by other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35603?
CVE-2026-35603 is a medium-severity vulnerability in anthropics claude-code, published on 17 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created or access-restricted, a low-privileged local user could create this directory and place a malicious configuration file that would be automatically loaded for any user launching Claude Code on the same machine. Exploiting this would have required a shared multi-user Windows system and a victim user to launch Claude Code after the malicious configuration was placed. This issue has been fixed on version 2.1.75.
Weakness: CWE-426
Which versions are affected by CVE-2026-35603?
2 open source packages ship an affected version, including @anthropic-ai/claude-code. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@anthropic-ai/claude-code npm | All versions | 2.1.75 |
@anthropic-ai/claude-code npm | All versions | 2.1.75 |
Products include Anthropic Claude Code.
How do I fix CVE-2026-35603?
Upgrade @anthropic-ai/claude-code to 2.1.75 or later.
Is CVE-2026-35603 being exploited?
There is no known exploitation of CVE-2026-35603 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in anthropics claude-code
- CVE-2025-66032 Claude Code Command Validation Bypass Allows Arbitrary Code Execution
- CVE-2025-64755 @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
- CVE-2025-59536 Claude Code's startup trust dialog could lead to Command Execution attack
- CVE-2025-58764 Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution
- CVE-2025-59041 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
Sources
Also known as GHSA-5cwg-9f6j-9jvx, MINI-qrr7-fm24-57q7, MINI-rfw4-vr5x-x6xr.