A vulnerability, which was classified as critical , has been found in jarrodwatts claude-hud up to 0.0.12 . This impacts an unknown function. The manipulation of the argument transcript_path leads to path traversal. This vulnerability is referenced as CVE-2026-47091 . The attack can only be performed from a local environment. No exploit is available. It is suggested to install a patch to address this issue.