{"action":"Upgrade claude-code-cache-fix to 3.5.2 or later.","affected":[{"fixed":"3.5.2","introduced":"3.5.0"}],"component":"claude-code-cache-fix","cve_ids":["CVE-2026-45136"],"ecosystem":"npm","epss":0.00188,"exploited":false,"fixed_versions":["3.5.2"],"ghsa_id":"GHSA-g3xq-3gmv-qq8g","id":"tcs_01M5KFPYXDFCQ2K4226H3HBW42","modified_at":"2026-06-09T00:00:19.227252611Z","published_at":"2026-05-13T15:31:41Z","references":["https://osv.dev/vulnerability/GHSA-g3xq-3gmv-qq8g","https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g","https://nvd.nist.gov/vuln/detail/CVE-2026-45136","https://github.com/cnighswonger/claude-code-cache-fix/issues/108","https://github.com/cnighswonger/claude-code-cache-fix/pull/110","https://github.com/cnighswonger/claude-code-cache-fix/commit/613e4df30547f3e6baf32d161eddc828f171da17","https://github.com/cnighswonger/claude-code-cache-fix"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-g3xq-3gmv-qq8g","url":"https://osv.dev/vulnerability/GHSA-g3xq-3gmv-qq8g"}],"summary":"claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh"}