CVE-2026-73222

Received Received - Intake

Remote Code Execution in Claude Code Templates

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73222

EUVD

EUVD-2026-56858

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-73222 is an unauthenticated remote code execution (RCE) vulnerability in the Claude Code Studio server component of claude-code-templates. The server, launched via the --studio option, bound to all network interfaces on port 3444 with no authentication and permissive CORS settings. Attackers could exploit POST endpoints like /api/execute and /api/install-agent by injecting shell metacharacters into request fields such as 'prompt' or 'agentName'. The server used child_process.spawn with shell: true, which concatenated arguments into a single shell command, enabling arbitrary OS command execution.

Detection Guidance

Check if the Claude Code Studio server is running on port 3444 by using netstat or ss commands like 'netstat -tulnp | grep 3444' or 'ss -tulnp | grep 3444'. If the server is bound to 0.0.0.0, it is vulnerable. Test for open endpoints by sending a POST request to http://localhost:3444/api/execute with a payload like '{"prompt":"test"}' using curl.

Use 'curl -X POST http://localhost:3444/api/execute -H "Content-Type: application/json" -d '{"prompt":"test"}' to check if the endpoint responds.

Impact Analysis

This vulnerability allows attackers to execute arbitrary operating-system commands with the developer's privileges. This could lead to full compromise of the developer's user account, including access to source code, SSH keys, cloud credentials, and local data. Exploitation is possible either by tricking a developer into visiting a malicious website (drive-by attack) or by accessing the server directly from the local network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including source code, credentials, and local files, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements for safeguarding personal or protected health information.

Mitigation Strategies

Immediately upgrade to version 1.29.4 or later of claude-code-templates. If upgrading is not possible, disable the --studio server by avoiding its use until patched. Ensure the server is not exposed to untrusted networks or the internet.

Bind the server to localhost only (127.0.0.1) instead of all interfaces (0.0.0.0).

Hi! I’m here to help you understand CVE-2026-73222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70