Executive brief
@siteboon/claude-code-ui is a Node.js-based code editor interface that allows users to configure Git settings. The application's /api/user/git-config endpoint is vulnerable to shell command injection, allowing authenticated attackers to execute arbitrary OS commands on the server. An attacker could read sensitive files, install backdoors, or pivot to other systems on the network.
Technical details
The vulnerability exists in server/routes/user.js (lines 58–59), where user-supplied gitName and gitEmail values are interpolated directly into bash command strings passed to child_process.exec(). Although double quotes are escaped, backticks (`) and $() command substitution syntax are still evaluated by the shell, allowing arbitrary command execution. The attack requires JWT authentication, though a separate hardcoded JWT flaw (VULN-01) can bypass this. An authenticated attacker can inject commands via the gitName or gitEmail parameters to achieve remote code execution as the Node.js process user. The fix involves replacing exec() with spawn() and passing arguments as an array to prevent shell interpretation.
Affected products
- siteboon claude-code-ui <= 1.23.0
Timeline
- 2026-03-10: disclosed
- 2026-03-10: patched: Fixed in v1.24.0