CVE-2026-73222 Overview
CVE-2026-73222 is a command injection vulnerability [CWE-78] in Claude Code Templates, a Command Line Interface (CLI) tool used to configure and monitor Claude Code. Versions prior to 1.29.4 ship a Studio server that binds to all network interfaces on port 3444, allows cross-origin requests, and requires no authentication. Attacker-controlled fields sent to /api/execute and /api/install-agent reach child_process.spawn() with shell execution enabled. An attacker who can reach the port, or who lures a developer running Studio to a malicious website, can execute arbitrary operating system commands with the developer's privileges.
Critical Impact
Remote command execution leads to compromise of source code, credentials, and local data on developer workstations running the Studio server.
Affected Products
- Claude Code Templates CLI versions prior to 1.29.4
- Component: cli-tool/src/sandbox-server.js (Studio server launched via --studio)
- Endpoints: POST /api/execute and POST /api/install-agent
Discovery Timeline
- 2026-08-11 - CVE-2026-73222 published to the National Vulnerability Database (NVD)
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-73222
Vulnerability Analysis
The Claude Code Studio server exposes an HTTP API on port 3444 that binds to all interfaces and permits cross-origin requests without authentication. The POST /api/execute endpoint reads the prompt field from the request body and forwards it to executeLocalTask(). The POST /api/install-agent endpoint reads the agentName field and passes it to a child process. The unsafe agent field path is also reachable from /api/execute through checkAndInstallAgent().
Because the values flow into child_process.spawn() with shell execution enabled, Node.js constructs a shell command in which metacharacters such as ;, |, &&, and backticks are interpreted rather than treated as literal input. This produces classic OS command injection [CWE-78] with the privileges of the developer running Studio.
Root Cause
The root cause is the combination of an unauthenticated, network-exposed HTTP listener with unsafe process invocation. Request-body fields are concatenated into a shell command through spawn() with the shell option enabled, so any shell metacharacter supplied by the caller is executed by the underlying shell.
Attack Vector
Two exploitation paths exist. First, any attacker with network reachability to port 3444 can send crafted JSON to /api/execute or /api/install-agent and execute commands directly. Second, because cross-origin requests are permitted and no authentication is required, a developer who visits a malicious website while Studio is running can have their browser issue the same requests to localhost:3444, achieving drive-by command execution.
Exploitation code is not published in this advisory. See the GitHub Security Advisory and the GitHub Commit History for technical details of the fix.
Detection Methods for CVE-2026-73222
Indicators of Compromise
- Unexpected listener bound to 0.0.0.0:3444 on developer workstations
- HTTP POST requests to /api/execute or /api/install-agent from unfamiliar Origin or Referer headers
- node processes spawning shells (/bin/sh, bash, cmd.exe) with request-derived arguments containing shell metacharacters
- Outbound network connections from node child processes to attacker-controlled hosts
Detection Strategies
- Inspect process lineage for node parents spawning shell interpreters with unusual command strings shortly after HTTP activity on port 3444
- Monitor for cross-origin HTTP requests to localhost:3444 originating from browser processes
- Alert on new bindings to TCP 3444 on endpoints that do not run Claude Code Templates by policy
Monitoring Recommendations
- Collect endpoint process telemetry and correlate child_process.spawn shell invocations with HTTP listener activity
- Log web proxy and browser telemetry for outbound requests to 127.0.0.1:3444 or localhost:3444
- Track installed Claude Code Templates CLI versions across developer machines and flag anything below 1.29.4
How to Mitigate CVE-2026-73222
Immediate Actions Required
- Upgrade Claude Code Templates to version 1.29.4 or later on all developer workstations
- Stop any running Studio server started with the --studio flag until the upgrade is applied
- Audit developer endpoints for prior exposure by reviewing shell process history and outbound connections from node
Patch Information
The issue is fixed in Claude Code Templates version 1.29.4. Refer to the GitHub Changelog Document and the fix in the GitHub Commit History.
Workarounds
- Do not launch the Studio server with --studio on untrusted networks until patched
- Restrict access to TCP port 3444 with a host firewall so only loopback traffic is accepted
- Avoid browsing untrusted websites while the Studio server is running to reduce drive-by request risk
- Run the CLI in a restricted account or container to limit the impact of command execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
