TI-2026-24413 Aliases CVE-2026-31861 GHSA-7fv4-fmmc-86g2

Shell Command Injection in Git Routes [CloudCLI UI]

HIGH 79CWE-94Published 2026-03-11 · Updated 2026-03-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash. This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint. This vulnerability is fixed in 1.24.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.06848 94th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed claudecodeui (siteboon): 1.24.0@siteboon/claude-code-ui (npm): 1.24.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
siteboon	claudecodeui	before 1.24.0	1.24.0	Patch available	CNA
—	@siteboon/claude-code-ui (npm)	before 1.24.0	1.24.0	Patch available	GHSA-7fv4-fmmc-86g2

claudecodeui Vendorsiteboon Affected before 1.24.0 Fixed in 1.24.0 Patch available CNA
@siteboon/claude-code-ui (npm) Vendor— Affected before 1.24.0 Fixed in 1.24.0 Patch available GHSA-7fv4-fmmc-86g2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudcli:cloud_cli::::::::	before 1.24.0	Vulnerable	siteboon

cpe:2.3:a:cloudcli:cloud_cli:*:*:*:*:*:*:*:* Versions before 1.24.0 Vulnerable ·siteboon

Remediation

Fix · CNA claudecodeui (siteboon) Fixed in 1.24.0
Fix · GHSA-7fv4-fmmc-86g2 @siteboon/claude-code-ui (npm) Fixed in 1.24.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-31861
2026-10-03 Alias added: GHSA-7fv4-fmmc-86g2
2026-10-25 EPSS moved to the 90th–95th percentile

References

Other 2

TI-2026-24519 Cloud CLI WebSocket shell injection CVSS 4.0HIGH 8.7
TI-2026-24414 Cloud CLI has Command Injection via Multiple Parameters CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences