CVE-2026-31975: Cloud CLI OS Command Injection Vulnerability

CVE-2026-31975 Overview

CVE-2026-31975 is a high-severity OS Command Injection vulnerability discovered in Cloud CLI (also known as Claude Code UI), a desktop and mobile user interface for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to version 1.25.0, the application fails to sanitize user-supplied input from WebSocket message payloads before interpolating them into bash command strings, enabling arbitrary OS command execution.

The vulnerability exists in server/index.js where the projectPath and initialCommand parameters are taken directly from WebSocket messages and incorporated into shell commands without proper validation or escaping. A secondary injection vector was also identified via the unsanitized sessionId parameter, providing multiple attack surfaces for exploitation.

Critical Impact

Attackers with network access and low privileges can execute arbitrary operating system commands on vulnerable systems, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Affected Products

• Cloud CLI (Claude Code UI) versions prior to 1.25.0
• Desktop and mobile deployments using vulnerable WebSocket shell functionality
• Environments exposing the WebSocket interface to untrusted networks

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-31975 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31975

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw allows authenticated users with network access to inject arbitrary shell commands through the WebSocket interface.

The attack can be executed over the network with low complexity and requires only low-level privileges. No user interaction is needed for exploitation, and successful attacks can result in high impact to confidentiality, integrity, and availability of the affected system.

The vulnerability represents a classic case of insufficient input validation where user-controlled data flows directly into a security-sensitive operation (command execution) without proper sanitization boundaries.

Root Cause

The root cause stems from insecure coding practices in server/index.js where WebSocket message parameters are directly concatenated into bash command strings. The developers failed to implement proper input sanitization, output encoding, or parameterized command execution when handling the following fields:

• projectPath - The project directory path parameter
• initialCommand - The initial shell command to execute
• sessionId - The session identifier

These values are interpolated directly into shell commands using string concatenation or template literals, allowing an attacker to inject shell metacharacters and escape the intended command context.

Attack Vector

The vulnerability is exploitable via network-accessible WebSocket connections. An attacker can craft malicious WebSocket messages containing shell metacharacters (such as ;, |, &&, $(), or backticks) within the projectPath, initialCommand, or sessionId parameters.

When the server processes these messages, the injected commands are executed with the privileges of the application process. For example, an attacker could inject commands to:

• Read sensitive configuration files and credentials
• Establish reverse shells for persistent access
• Download and execute additional malware
• Modify or delete critical application data
• Pivot to other systems on the internal network

The secondary injection vector via sessionId provides an alternative attack path if the primary parameters are later hardened without addressing all input sources.

Detection Methods for CVE-2026-31975

Indicators of Compromise

• Unexpected child processes spawned by the Cloud CLI server process
• WebSocket messages containing shell metacharacters like ;, |, &&, $(), or backticks in projectPath, initialCommand, or sessionId fields
• Unusual outbound network connections from the server to external IP addresses
• Modifications to system files or creation of unexpected files by the application user account

Detection Strategies

• Monitor WebSocket traffic for suspicious patterns including shell metacharacters in message payloads
• Implement application-level logging to capture all WebSocket message parameters before processing
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process execution chains
• Use web application firewalls (WAF) configured to detect command injection patterns in WebSocket traffic

Monitoring Recommendations

• Enable verbose logging for the Cloud CLI server to capture incoming WebSocket messages
• Configure alerting for any shell commands executed by the server process outside expected patterns
• Monitor system call activity using auditd or similar tools to detect command execution anomalies
• Review server logs regularly for attempted exploitation attempts

How to Mitigate CVE-2026-31975

Immediate Actions Required

• Upgrade Cloud CLI (Claude Code UI) to version 1.25.0 or later immediately
• If immediate patching is not possible, restrict network access to the WebSocket interface to trusted clients only
• Audit logs for any signs of exploitation prior to patching
• Consider running the application in a sandboxed environment with minimal privileges

Patch Information

The vulnerability has been fixed in Cloud CLI version 1.25.0. The patch implements proper input sanitization for WebSocket message parameters before they are used in shell command construction.

Review the GitHub commit 12e7f07 for technical details on the fix implementation. The v1.25.0 release is available for download from the official GitHub repository.

For complete vulnerability details, refer to the GitHub Security Advisory GHSA-gv8f-wpm2-m5wr.

Workarounds

• Implement network segmentation to restrict WebSocket access to trusted internal clients only
• Deploy a reverse proxy or WAF to filter incoming WebSocket messages for malicious patterns
• Run the Cloud CLI server with minimal OS privileges to limit the impact of successful exploitation
• Disable the WebSocket shell functionality entirely if not required for operations

# Example: Restrict WebSocket access using iptables (Linux)
# Allow only trusted internal subnet to access the WebSocket port
iptables -A INPUT -p tcp --dport 3000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP