Unauthenticated Remote Code Execution in Claude Code Studio

Claude Code Studio, an HTTP server provided by the claude-code-templates npm package (v1.29.2 and earlier), contains a critical OS command injection vulnerability (CVE-2026-73222). When invoked via npx claude-code-templates --studio, the application binds an Express server to all network interfaces (0.0.0.0) on port 3444 without authentication. The server explicitly allows cross-origin requests by setting Access-Control-Allow-Origin: *.

Two API endpoints, /api/execute and /api/install-agent, pass user-controlled input fields directly into child_process.spawn with the { shell: true } option. This configuration instructs Node.js to invoke the shell to interpret the command string, causing shell metacharacters provided in input fields to execute as system commands. Any unauthenticated attacker with network reachability to the developer's machine, or a malicious website capable of performing a cross-origin POST request, can achieve remote code execution with the developer's privileges.

Attack Chain

1. The developer executes npx claude-code-templates --studio on their local machine, starting an insecure HTTP server on port 3444.
2. The server binds to 0.0.0.0, making it accessible to any device on the local network (LAN) and susceptible to cross-origin web requests.
3. An attacker triggers an HTTP POST request to the /api/execute or /api/install-agent endpoint.
4. The request payload includes malicious command injection syntax (e.g., ; touch /tmp/pwned) within the prompt or agentName fields.
5. The Express server receives the payload and passes the unvalidated input strings into child_process.spawn.
6. Because shell: true is enabled, the Node.js runtime executes the input through the system shell (e.g., sh -c).
7. The system shell interprets the injected metacharacters, executing the attacker's arbitrary command.
8. The attacker achieves full code execution on the developer's host, gaining access to local files, SSH keys, and environment secrets.

Impact

The vulnerability results in total compromise of the developer's local account. Successful exploitation grants an attacker the ability to exfiltrate source code, SSH keys, cloud credentials, and sensitive environment variables. This affects all developers utilizing the --studio mode of the Claude Code Templates tool globally.

Recommendation

Prioritized actions for detection and mitigation:

• Upgrade claude-code-templates to a version strictly newer than 1.29.2 as soon as a patch is available.
• Until patched, avoid using the --studio flag or ensure the local machine is not reachable by untrusted networks.
• Deploy the provided detection rule to monitor for suspicious POST requests to local ports 3444 or related studio services.
• Restrict network access to the port 3444 by implementing host-based firewall rules to permit only localhost traffic.