{"data":{"id":"4ec3ae43-746e-4e0b-817c-85a87742a4c1","title":"CVE-2026-73222: Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio…","summary":"Claude Code Templates versions before 1.29.4 ship a Claude Code Studio server, started with the --studio option, that binds to all interfaces on port 3444, allows cross-origin requests, and requires no authentication. Request-body fields prompt and agentName reach child_process.spawn() with shell execution enabled, so shell metacharacters are interpreted, letting an attacker who can reach the port, or lure a developer to a malicious website, run arbitrary OS commands with the developer's privileges.","solution":"Fixed in 1.29.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73222","publishedAt":"2026-08-11T19:18:51.720Z","cveId":"CVE-2026-73222","cweIds":["CWE-78","CWE-306","CWE-352"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["claude-code-templates@<= 1.29.2 (fixed: 1.29.4)"],"affectedPackageNames":["claude-code-templates"],"affectedPackageRefs":["npm:claude-code-templates"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","Claude Code Templates","Claude Code Studio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Claude Code Templates Studio command execution via unauthenticated API","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00319,"epssCheckedAt":"2026-11-11T06:13:01.509Z","kevDateAdded":null,"advisoryAliases":["GHSA-79wm-x847-7cvg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:45:33.748Z","patchAvailable":true,"disclosureDate":"2026-08-11T19:18:51.720Z","fixReleasedAt":"2026-07-14T23:20:17.206Z","daysToFix":-28,"fixCheckedAt":"2026-10-29T21:32:03.955Z","capecIds":["CAPEC-115","CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"claude-code-templates","fixedVersion":"1.29.4","matchedVersion":"1.29.4","fixReleasedAt":"2026-07-14T23:20:17.206Z","daysToFix":-28,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:03.798Z"}]}}