0xBlackash/CVE-2026-7574

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that modifies the rootfs.img of Anthropic Claude Desktop Cowork VM by extracting, mounting, injecting a canary file, and reinserting the partition, demonstrating persistent code execution inside the VM.

Backdoor review

No backdoor observed in reviewed code

The PoC script (CVE-2026-7574.sh) and README.md demonstrate a local VM image tampering vulnerability. The script performs a harmless canary injection (writing a text file and a cron comment) to prove the integrity bypass. No concealed executable behavior, credential theft, remote access, persistence mechanism beyond the described PoC, or unrelated payload is present. The script's actions are transparent and align with the stated educational purpose.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesShell
Target softwareAnthropic Claude Desktop Cowork
Attack typesLocal Privilege EscalationPersistence
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively modifies the target VM image to inject persistent content, which constitutes exploitation rather than mere detection or scanning. It performs extraction, mounting, file injection, and reinsertion of the modified partition, directly exercising the vulnerability.

CVE-2026-7574.sh:36-64

Requirements

  • Local unprivileged code execution as the victim macOS userCVE-2026-7574.sh:1
  • Cowork VM must have been run at least once to download the rootfs.imgCVE-2026-7574.sh:18-21
  • Linux environment with ext4 support or macOS with macFUSE and ext4 tools for mountingCVE-2026-7574.sh:58

Observed behavior

  • Locates the rootfs.img at ~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.imgCVE-2026-7574.sh:13
  • Extracts the ext4 partition using dd with hardcoded offsetsCVE-2026-7574.sh:36
  • Mounts the extracted partition and writes a canary file /etc/0xblackash-poc.txt and a cron markerCVE-2026-7574.sh:45-49
  • Reinserts the modified partition back into the original rootfs.img using ddCVE-2026-7574.sh:64
  • Instructs the user to verify persistence by launching the VM and checking the canary fileCVE-2026-7574.sh:68-73
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
/etc/0xblackash-poc.txtHarmless canary file written to the mounted VM image to demonstrate successful tampering.CVE-2026-7574.sh:45
File Write
/etc/cron.d/blackash-pocHarmless comment appended to a cron file as a persistent marker.CVE-2026-7574.sh:49
Commented Code
sudo cp /path/to/payload.sh "$MNT/usr/local/bin/"Commented-out example of a more advanced payload; not executed.CVE-2026-7574.sh:52
Review boundaries

What the analysis did not establish

  • Hardcoded dd offsets may not match all versions; script warns to verify with gdisk/parted.
  • Requires sudo for mount, which may not be available in all environments.
  • Only a harmless canary is injected; more advanced payloads are commented out.
  • Review is limited to the supplied text files; no binary files were present or analyzed.
  • The script requires sudo and modifies system files, which could be harmful if misused, but the script itself contains no backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1