Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.
Affected: npm: @siteboon/claude-code-ui
# Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection Download: [cve_claudecodeui_submission_v2.zip](https://github.com/user-attachments/files/25686652/cve_claudecodeui_submission_v2.zip)
## ļ Submission Info
| Field | Value | |-------|-------| | **Package** | `@siteboon/claude-code-ui` | | **Ecosystem** | npm | | **Affected versions** | `<= 1.24.0` (latest) | | **Severity** | Critical | | **CVSS Score** | 9.8 | | **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | | **CWE** | CWE-1188, CWE-287, CWE-78 | | **Reported** | 2026-03-02 | | **Researcher** | Ethan-Yang (OPCIA) |
---
## Summary
Three chained vulnerabilities allow **unauthenticated remote code execution** on any claudecodeui instance running with default configuration. No account, credentials, or prior access is required.
The root cause of RCE is **OS command injection (CWE-78)** in the WebSocket shell handler. Authentication is bypassed by combining an insecure default JWT secret **(CWE-1188)** with a WebSocket authentication function that skips database user validation **(CWE-287)**.
---
## Vulnerability Details
### 1. Insecure Default JWT Secret ā `CWE-1188`
**File**: `server/middleware/auth.js`, line 6
```javascript const JWT_SECRET = process.env.JWT_SECRET || 'claude-ui-dev-secret-change-in-production'; ```
The server uses an environment variable for `JWT_SECRET`, but falls back to a well-known default value when the vā¦