CVE-2026-73222
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Claude Code Templates before version 1.29.4 contains a vulnerability in the Studio server launched by the --studio option. The server binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute and /api/install-agent endpoints pass attacker-controlled data to child_process.spawn with shell execution enabled, allowing arbitrary OS command execution. The issue is fixed in version 1.29.4.
Risk Assessment
An attacker who can reach the port or convince a developer to visit a malicious website can execute arbitrary commands with the developer's privileges, potentially leading to theft of source code, credentials, and local data.
Recommendation
Update Claude Code Templates to version 1.29.4 or later and restrict access to port 3444.
Original NVD description (English source)
Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.