CVE-2026-73222: Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
npx claude-code-templates --studio launches “Claude Code Studio”, an Express HTTP server (cli-tool/src/sandbox-server.js, default port 3444) that binds to all interfaces (0.0.0.0), sets Access-Control-Allow-Origin: *, and requires no authentication. Two POST endpoints pass attacker-controlled request-body fields into child_process.spawn(..., { shell: true }). Because shell: true makes Node join the argv array into a single sh -c string, the fields are parsed by the shell and metacharacters execute. Any unauthenticated attacker who can reach the port — a malicious web page the developer visits, or anyone on the same LAN — can execute arbitrary OS commands on the developer’s machine.
References
- github.com/advisories/GHSA-79wm-x847-7cvg
- github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md
- github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783
- github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg
- nvd.nist.gov/vuln/detail/CVE-2026-73222
Code Behaviors & Features
Detect and mitigate CVE-2026-73222 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →