CVE-2026-31861

Katalog CVE

CVSS 8.8 · High EPSS 0,71%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada cloudcli cloud cli. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash. This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint. This vulnerability is fixed in 1.24.0.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/siteboon/claudecodeui/security/advisories/GHSA-7fv4-fmmc-86g2 exploit · advisory vendor
• https://github.com/siteboon/claudecodeui/commit/86c33c1c0cb34176725a38f46960213714fc3e04 patch
• https://github.com/siteboon/claudecodeui/releases/tag/v1.24.0 release notes