CVE-2026-73222 in claude-code-templates
Summary
by MITRE • 08/11/2026
Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within Claude Code Templates, a command-line interface tool designed for configuring and monitoring Claude Code development environments. The flaw manifests in the Claude Code Studio server functionality that is initiated through the --studio option in the cli-tool/src/sandbox-server.js file. Prior to version 1.29.4, the server demonstrates poor security configuration by binding to all network interfaces on port 3444, making it accessible from any network location without requiring authentication. The server's CORS (Cross-Origin Resource Sharing) policy is overly permissive, allowing requests from any origin which creates additional attack surface. This misconfiguration fundamentally undermines the security boundaries of the development environment.
The technical exploitation occurs through two primary endpoints that process user-controlled input directly into system execution pathways. The POST /api/execute endpoint accepts a prompt request-body field that gets passed to executeLocalTask(), while the POST /api/install-agent endpoint processes an agentName request-body field and passes it to a child process. Both of these attacker-controllable values eventually reach the child_process.spawn() function with shell execution enabled, creating a classic command injection vulnerability. The vulnerability stems from Node.js constructing shell commands where metacharacters are interpreted rather than treated as literal input, allowing attackers to execute arbitrary system commands through carefully crafted payloads.
The operational impact of this vulnerability is severe and directly threatens the security of development environments. An attacker with network access to port 3444 can execute arbitrary operating-system commands with the privileges of the developer running the Studio server. This privilege escalation capability enables full compromise of source code repositories, exposure of sensitive credentials stored locally, and potential access to local data that developers may be handling. The vulnerability is particularly dangerous because it can be exploited through direct network access or by tricking a developer into visiting a malicious website, making it a significant risk for insecure development practices. The attack vector through checkAndInstallAgent() demonstrates how the same unsafe input path can be reached through multiple code execution flows, amplifying the exploitability.
This vulnerability maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-352 (Cross-Site Request Forgery), with behaviors aligning with ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1059.003 (Command and Scripting Interpreter: Windows Command Shell). The root cause lies in insecure deserialization of user input into system commands without proper sanitization or validation, a common pattern that violates fundamental security principles for handling untrusted data in execution contexts. The fix implemented in version 1.29.4 addresses the core issue by properly validating and sanitizing all user-controllable inputs before they reach system execution functions, ensuring that special characters are appropriately escaped or removed from command construction.
The vulnerability demonstrates how development tools can inadvertently create security risks when they expose network services without proper access controls or authentication mechanisms. The combination of open network binding, permissive CORS policies, and lack of input validation creates a dangerous environment where local development tools become attack vectors for remote exploitation. Organizations should implement comprehensive security measures including network segmentation, access control restrictions, and regular security assessments of development tooling to prevent similar vulnerabilities from compromising development environments and the sensitive data they handle.