Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@siteboon/claudecodeui

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1npmAmendedPublished

    @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters

    CVE-2026-31862 · GHSA-f2fc-vc88-6w7q

    Affected
    • npm @siteboon/claudecodeui <= 1.23.0
    Fixed in
    1.24.0· Vendor fix available
    Issue
    Multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands. Details The claudecodeui application provides Git integration through various API endpoints. These endpoints accept user-controlled parameters such as file paths, branch names, commit messages, and commit hashes, which are directly interpolated into shell command strings passed to execAsync(). The application attempts to escape double quotes in some parameters, but this protection is trivially bypassable using other shell metacharacters such as: Command substitution: $(command) or \command\ Command chaining: ;, &&, || Newlines and other control characters Affected Endpoints GET /api/git/diff - file parameter GET /api/git/status - file parameter POST /api/git/commit - files array and message parameter POST /api/git/checkout - branch parameter POST /api/git/create-branch -…

    Recommended action: Upgrade to 1.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →