CVE-2026-31861
Description
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash. This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint. This vulnerability is fixed in 1.24.0.
How to fix
- cloudcli cloud_cli1.24.0 or later
- @siteboon/claude-code-ui1.24.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudcli cloud_cli | v < 1.24.0 | 1.24.0 |
| @siteboon/claude-code-uinpm | v < 1.24.0 | 1.24.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.