Description

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T19:18:51.720Z",
  "pubdate": "2026-08-11T19:18:51.720Z",
  "executiveSummary": "A remote code execution vulnerability exists in the Claude Code Studio server component of Claude Code Templates prior to version 1.29.4. The vulnerability stems from insecure network binding, lack of authentication, permissive cross-origin request handling, and unsafe command execution via child processes. The server binds to all network interfaces on port 3444 without requiring authentication and accepts cross-origin requests. An attacker capable of reaching the port directly, or who successfully lures a developer running Studio into visiting a malicious website, can trigger arbitrary operating-system command execution with the privileges of the hosting user. This creates severe risk implications, potentially compromising source code, local credentials, and sensitive local data.",
  "technicalDetails": "The vulnerability resides in the Claude Code Studio server implemented within cli-tool/src/sandbox-server.js, specifically affecting versions prior to 1.29.4. When the server is initialized via the --studio option, it binds to all available network interfaces on port 3444. Furthermore, the server configuration permits cross-origin requests and enforces no authentication mechanisms for incoming API calls.\nThe attack vector involves two primary HTTP endpoints exposed by the server. The POST /api/execute endpoint processes the prompt request-body field and passes it directly to the executeLocalTask() function. Additionally, the POST /api/install-agent endpoint accepts the agentName request-body field and forwards it to a child process. The identical unsafe agent field path is also reachable via checkAndInstallAgent() through /api/execute.\nThe root cause of the vulnerability is the transmission of attacker-controlled values to child_process.spawn() with shell execution enabled. This causes Node.js to construct an underlying shell command where shell metacharacters are actively interpreted rather than being treated as literal arguments.\nThe attack flow proceeds as follows: First, an external adversary establishes network reachability to port 3444, or alternatively leverages a browser-based attack by convincing a developer running the Studio server to visit a malicious website that issues cross-origin requests to the local server. Second, the adversary transmits a crafted HTTP POST request to either /api/execute or /api/install-agent containing malicious input within the prompt or agentName request body fields. Third, the server passes these unsanitized parameters into internal execution functions that invoke child_process.spawn() with shell evaluation enabled. Finally, the shell interprets the metacharacters embedded within the payload, resulting in the execution of arbitrary operating-system commands.\nPost-exploitation impact includes complete system compromise under the security context of the developer running the tool, leading to unauthorized access, exfiltration, or destruction of local source code, environment credentials, and local data."
}