Security researcher edbr has disclosed a vulnerability in Claude Code, Anthropic's command-line coding assistant, that allowed the application to load configuration files from a world-writable directory on Windows systems — creating a potential vector for local privilege escalation or configuration hijacking.

The Vulnerability: CVE-2026-35603

The flaw stemmed from how Claude Code resolved its configuration path on Windows. Instead of strictly using a user-controlled or system-protected location, the application would read settings from a folder accessible to any local user on the machine. This meant one user could craft a malicious config file that another user's Claude Code session would blindly trust and execute.

Severity and Disclosure Timeline

The vulnerability was assigned CVE-2026-35603 and classified as Moderate severity — not catastrophic, but serious enough for Anthropic to prioritize a patch. The researcher reported the issue through HackerOne's bug bounty program, following responsible disclosure practices that gave Anthropic time to remediate before public exposure.

Patch Status

According to the report summary on DEV.to, this CVE has already been patched. Users running Claude Code on Windows should ensure they're on the latest version to benefit from the fix. The exact patch version wasn't specified in the available source material, but updating through standard channels — npm update -g @anthropic-ai/claude-code or equivalent package managers — should resolve the issue.

Why This Matters for Developer Tooling

This kind of vulnerability is a reminder that security assumptions baked into cross-platform tooling often break down at the edges. Windows permission models differ significantly from Unix derivatives, and configuration loading is an underestimated attack surface. Tools that handle code access, file system operations, and API credentials need especially tight controls here.

Key Takeaways

  • CVE-2026-35603 affects Claude Code on Windows specifically
  • The flaw involved loading config from a world-writable directory
  • Severity rated as Moderate; patch is already available
  • Reported via HackerOne by researcher edbr using responsible disclosure

The Bottom Line

Anthropic moved quickly enough that this one didn't make headlines as an active exploit — but it underscores that even well-funded AI companies shipping developer tooling need rigorous Windows-specific security review. If you're running Claude Code on a shared or multi-user Windows machine, update now and keep an eye on your config directory permissions.