{"data":{"id":"a631de4d-b758-4475-9d88-c5eb345451a3","title":"CVE-2026-31861: Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to…","summary":"CVE-2026-31861 affects Cloud CLI (aka Claude Code UI) prior to 1.24.0. The /api/user/git-config endpoint interpolates user-supplied gitName and gitEmail values into shell command strings passed to child_process.exec(), escaping only the double quote character. Backticks, $() substitution and backslash sequences remain interpreted inside double quotes, letting an authenticated attacker run arbitrary OS commands.","solution":"Fixed in 1.24.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31861","publishedAt":"2026-03-11T18:16:24.887Z","cveId":"CVE-2026-31861","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@siteboon/claude-code-ui@<= 1.23.0 (fixed: 1.24.0)"],"affectedPackageNames":["@siteboon/claude-code-ui"],"affectedPackageRefs":["npm:@siteboon/claude-code-ui"],"affectedVendors":[],"affectedVendorsRaw":["Claude Code UI","Cloud CLI","Claude Code","Cursor CLI","Codex","Gemini-CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Cloud CLI command injection through the git-config endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.06273,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":["GHSA-7fv4-fmmc-86g2"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:29.871Z","patchAvailable":true,"disclosureDate":"2026-03-11T18:16:24.887Z","fixReleasedAt":"2026-03-09T08:38:52.782Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:39:57.799Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@siteboon/claude-code-ui","fixedVersion":"1.24.0","matchedVersion":"1.24.0","fixReleasedAt":"2026-03-09T08:38:52.782Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:57.652Z"}]}}