{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aanthropicclaude_code_templates/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:anthropic:claude_code_templates:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-73222"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["claude-code-templates (\u003c= 1.29.2)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","injection","express","nodejs"],"_cs_type":"advisory","_cs_vendors":["Anthropic"],"content_html":"\u003cp\u003eClaude Code Studio, an HTTP server provided by the \u003ccode\u003eclaude-code-templates\u003c/code\u003e npm package (v1.29.2 and earlier), contains a critical OS command injection vulnerability (CVE-2026-73222). When invoked via \u003ccode\u003enpx claude-code-templates --studio\u003c/code\u003e, the application binds an Express server to all network interfaces (0.0.0.0) on port 3444 without authentication. The server explicitly allows cross-origin requests by setting \u003ccode\u003eAccess-Control-Allow-Origin: *\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eTwo API endpoints, \u003ccode\u003e/api/execute\u003c/code\u003e and \u003ccode\u003e/api/install-agent\u003c/code\u003e, pass user-controlled input fields directly into \u003ccode\u003echild_process.spawn\u003c/code\u003e with the \u003ccode\u003e{ shell: true }\u003c/code\u003e option. This configuration instructs Node.js to invoke the shell to interpret the command string, causing shell metacharacters provided in input fields to execute as system commands. Any unauthenticated attacker with network reachability to the developer's machine, or a malicious website capable of performing a cross-origin POST request, can achieve remote code execution with the developer's privileges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe developer executes \u003ccode\u003enpx claude-code-templates --studio\u003c/code\u003e on their local machine, starting an insecure HTTP server on port 3444.\u003c/li\u003e\n\u003cli\u003eThe server binds to \u003ccode\u003e0.0.0.0\u003c/code\u003e, making it accessible to any device on the local network (LAN) and susceptible to cross-origin web requests.\u003c/li\u003e\n\u003cli\u003eAn attacker triggers an HTTP POST request to the \u003ccode\u003e/api/execute\u003c/code\u003e or \u003ccode\u003e/api/install-agent\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request payload includes malicious command injection syntax (e.g., \u003ccode\u003e; touch /tmp/pwned\u003c/code\u003e) within the \u003ccode\u003eprompt\u003c/code\u003e or \u003ccode\u003eagentName\u003c/code\u003e fields.\u003c/li\u003e\n\u003cli\u003eThe Express server receives the payload and passes the unvalidated input strings into \u003ccode\u003echild_process.spawn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBecause \u003ccode\u003eshell: true\u003c/code\u003e is enabled, the Node.js runtime executes the input through the system shell (e.g., \u003ccode\u003esh -c\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe system shell interprets the injected metacharacters, executing the attacker's arbitrary command.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves full code execution on the developer's host, gaining access to local files, SSH keys, and environment secrets.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in total compromise of the developer's local account. Successful exploitation grants an attacker the ability to exfiltrate source code, SSH keys, cloud credentials, and sensitive environment variables. This affects all developers utilizing the \u003ccode\u003e--studio\u003c/code\u003e mode of the Claude Code Templates tool globally.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eclaude-code-templates\u003c/code\u003e to a version strictly newer than 1.29.2 as soon as a patch is available.\u003c/li\u003e\n\u003cli\u003eUntil patched, avoid using the \u003ccode\u003e--studio\u003c/code\u003e flag or ensure the local machine is not reachable by untrusted networks.\u003c/li\u003e\n\u003cli\u003eDeploy the provided detection rule to monitor for suspicious POST requests to local ports 3444 or related studio services.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the port 3444 by implementing host-based firewall rules to permit only localhost traffic.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-04T00:07:10Z","date_published":"2026-09-04T00:07:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-claude-code-rce/","summary":"An unauthenticated OS command injection vulnerability in the Claude Code Studio HTTP server allows remote attackers to execute arbitrary code via drive-by web requests or local network access.","title":"Unauthenticated Remote Code Execution in Claude Code Studio","url":"https://feed.craftedsignal.io/briefs/2026-09-claude-code-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:anthropic:claude_code_templates:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}