CVE-2026-31861: @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
(updated )
The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash.
This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint.
References
- github.com/advisories/GHSA-7fv4-fmmc-86g2
- github.com/siteboon/claudecodeui
- github.com/siteboon/claudecodeui/commit/86c33c1c0cb34176725a38f46960213714fc3e04
- github.com/siteboon/claudecodeui/releases/tag/v1.24.0
- github.com/siteboon/claudecodeui/security/advisories/GHSA-7fv4-fmmc-86g2
- nvd.nist.gov/vuln/detail/CVE-2026-31861
Code Behaviors & Features
Detect and mitigate CVE-2026-31861 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →