CVE-2026-45136 Details
Description
claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.
A local code execution vulnerability has been identified in the Claude Code Cache Fix tool, specifically in versions 3.5.0 prior to 3.5.2. The issue arises in the 'tools/quota-statusline.sh' script, which interpolates hook stdin payloads directly into a Python triple-quoted string. This allows for injection of Python code execution by manipulating the payload with a specific byte sequence. The vulnerability is present when the script is integrated into the Claude Code statusLine configuration, a setup recommended in the tool's README.
Users can upgrade to Claude Code Cache Fix version 3.5.2, which addresses the vulnerability by modifying the 'tools/quota-statusline.sh' script to prevent the injection. Alternatively, users can remove the 'statusLine' entry from their Claude Code settings or replace the default quota statusline script with a version that does not use the vulnerable Python interpolation method.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cnighswonger/claude-code-cache-fix/issues/108 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g | CISA-ADP | MitigationVendor Advisory |
| https://github.com/cnighswonger/claude-code-cache-fix/issues/108 | [email protected] | ExploitIssue Tracking |
| https://github.com/cnighswonger/claude-code-cache-fix/pull/110 | [email protected] | Issue TrackingPatch |
| https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cnighswonger claude-code-cache-fix | >= 3.5.0, < 3.5.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |