CVE-2026-45136: Cnighswonger Claude-Code-Cache-Fix

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.

Affected products

• Cnighswonger Claude-Code-Cache-Fix: from 3.5.0, before 3.5.2 (fixed in 3.5.2)

Published 2026-05-27. Last modified 2026-06-17.