Executive brief
Claude Code Templates is a developer tool that includes a local HTTP server (Claude Code Studio) for development assistance. When started with the --studio flag, the server accepts requests from any origin without authentication and executes arbitrary shell commands based on user-supplied input. An attacker can exploit this via a malicious web page the developer visits, or directly from the same local network, to gain full control over the developer's machine including access to source code, SSH keys, and cloud credentials.
Technical details
The vulnerability is an OS command injection (CWE-78) in the Claude Code Studio Express server (cli-tool/src/sandbox-server.js) running on default port 3444. The server listens on 0.0.0.0 with no host binding restriction, sets Access-Control-Allow-Origin: * to allow cross-origin requests, and implements no authentication. Two POST endpoints (/api/execute and /api/install-agent) pass attacker-controlled JSON body fields (prompt and agentName) unsanitized into Node.js child_process.spawn() calls with { shell: true }. When shell: true is used, Node builds a single command string by joining array arguments with spaces and executes it via sh -c, causing all arguments to be subject to shell parsing and metacharacter interpretation. The prompt field has only a minimum length validation (≥10 chars); agentName is completely unvalidated. An attacker can inject shell metacharacters (e.g., ;, |, $(...), backticks) to execute arbitrary commands. Attack vectors include drive-by exploitation via cross-origin fetch() from a malicious web page, or direct network access from the same LAN. Patched in version 1.29.4; versions ≤1.29.2 are vulnerable.
Affected products
- davila7 claude-code-templates <= 1.29.2
Timeline
- 2026-09-03: disclosed: GitHub Advisory published; CVE assigned 2026-08-11 by NVD
- 2026: patched: Patched in version 1.29.4