Cloud Cli
Monthly
OS command injection in Cloud CLI (Claude Code UI) before 1.25.0. EPSS 0.39%.
Command injection in Cloud CLI (Claude Code UI) Git operations before 1.24.0.
Arbitrary OS command execution in Cloud CLI versions prior to 1.24.0 allows authenticated users to inject malicious commands through improperly sanitized git configuration parameters passed to shell execution functions. The /api/user/git-config endpoint fails to properly escape bash metacharacters like backticks and $() substitutions, enabling attackers to execute arbitrary operating system commands with application privileges. No patch is currently available for affected deployments.
OS command injection in Cloud CLI (Claude Code UI) before 1.25.0. EPSS 0.39%.
Command injection in Cloud CLI (Claude Code UI) Git operations before 1.24.0.
Arbitrary OS command execution in Cloud CLI versions prior to 1.24.0 allows authenticated users to inject malicious commands through improperly sanitized git configuration parameters passed to shell execution functions. The /api/user/git-config endpoint fails to properly escape bash metacharacters like backticks and $() substitutions, enabling attackers to execute arbitrary operating system commands with application privileges. No patch is currently available for affected deployments.