CVE-2026-31975

Katalog CVE

CVSS 9.8 · Critical EPSS 4,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada cloudcli cloud cli. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

4,5% peluang dieksploitasi; lebih tinggi dari 91,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr exploit · advisory vendor
• https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26 patch
• https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0 release notes