https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 19:17:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275721 EUVD-2026-275721 https://cve.radiocsirt.org/vuln/euvd-2026-275721 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31975 <p>Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.</p> <p>Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31975 https://cve.radiocsirt.org/vuln/ghsa-gv8f-wpm2-m5wr <p><strong>Affected:</strong> npm: @siteboon/claude-code-ui</p> <p># Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection Download: [cve_claudecodeui_submission_v2.zip](https://github.com/user-attachments/files/25686652/cve_claudecodeui_submission_v2.zip)</p> <p>##  Submission Info</p> <p>| Field | Value | |-------|-------| | **Package** | `@siteboon/claude-code-ui` | | **Ecosystem** | npm | | **Affected versions** | `&lt;= 1.24.0` (latest) | | **Severity** | Critical | | **CVSS Score** | 9.8 | | **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | | **CWE** | CWE-1188, CWE-287, CWE-78 | | **Reported** | 2026-03-02 | | **Researcher** | Ethan-Yang (OPCIA) |</p> <p>---</p> <p>## Summary</p> <p>Three chained vulnerabilities allow **unauthenticated remote code execution** on any claudecodeui instance running with default configuration. No account, credentials, or prior access is required.</p> <p>The root cause of RCE is **OS command injection (CWE-78)** in the WebSocket shell handler. Authentication is bypassed by combining an insecure default JWT secret **(CWE-1188)** with a WebSocket authentication function that skips database user validation **(CWE-287)**.</p> <p>---</p> <p>## Vulnerability Details</p> <p>### 1. Insecure Default JWT Secret — `CWE-1188`</p> <p>**File**: `server/middleware/auth.js`, line 6</p> <p>```javascript const JWT_SECRET = process.env.JWT_SECRET || &#39;claude-ui-dev-secret-change-in-production&#39;; ```</p> <p>The server uses an environment variable for `JWT_SECRET`, but falls back to a well-known default value when the v…</p> <p><strong>Affected:</strong> npm: @siteboon/claude-code-ui</p> <p># Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection Download: [cve_claudecodeui_submission_v2.zip](https://github.com/user-attachments/files/25686652/cve_claudecodeui_submission_v2.zip)</p> <p>##  Submission Info</p> <p>| Field | Value | |-------|-------| | **Package** | `@siteboon/claude-code-ui` | | **Ecosystem** | npm | | **Affected versions** | `&lt;= 1.24.0` (latest) | | **Severity** | Critical | | **CVSS Score** | 9.8 | | **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | | **CWE** | CWE-1188, CWE-287, CWE-78 | | **Reported** | 2026-03-02 | | **Researcher** | Ethan-Yang (OPCIA) |</p> <p>---</p> <p>## Summary</p> <p>Three chained vulnerabilities allow **unauthenticated remote code execution** on any claudecodeui instance running with default configuration. No account, credentials, or prior access is required.</p> <p>The root cause of RCE is **OS command injection (CWE-78)** in the WebSocket shell handler. Authentication is bypassed by combining an insecure default JWT secret **(CWE-1188)** with a WebSocket authentication function that skips database user validation **(CWE-287)**.</p> <p>---</p> <p>## Vulnerability Details</p> <p>### 1. Insecure Default JWT Secret — `CWE-1188`</p> <p>**File**: `server/middleware/auth.js`, line 6</p> <p>```javascript const JWT_SECRET = process.env.JWT_SECRET || &#39;claude-ui-dev-secret-change-in-production&#39;; ```</p> <p>The server uses an environment variable for `JWT_SECRET`, but falls back to a well-known default value when the v…</p> https://cve.radiocsirt.org/vuln/ghsa-gv8f-wpm2-m5wr