{"data":{"id":"be0c0457-6f33-41c5-9955-9052ecdaefeb","title":"CVE-2026-31862: Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to…","summary":"CVE-2026-31862 affects Cloud CLI (aka Claude Code UI), a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI, prior to 1.24.0. Multiple Git-related API endpoints pass user-controlled parameters (file, branch, message, commit) into execAsync() through string interpolation, which lets an authenticated attacker execute arbitrary OS commands. The weakness is classified as CWE-78 (OS Command Injection).","solution":"Fixed in 1.24.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31862","publishedAt":"2026-03-11T18:16:25.073Z","cveId":"CVE-2026-31862","cweIds":["CWE-78"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@siteboon/claudecodeui@<= 1.23.0 (fixed: 1.24.0)"],"affectedPackageNames":["@siteboon/claudecodeui"],"affectedPackageRefs":["npm:@siteboon/claudecodeui"],"affectedVendors":[],"affectedVendorsRaw":["Claude Code UI","Cloud CLI","Claude Code","Cursor CLI","Codex","Gemini-CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Cloud CLI Git API endpoints allow OS command execution via user parameters","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"high","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00454,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-f2fc-vc88-6w7q"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:29.368Z","patchAvailable":true,"disclosureDate":"2026-03-11T18:16:25.073Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:39:57.059Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@siteboon/claudecodeui","fixedVersion":"1.24.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:39:56.912Z"}]}}