8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31861

CVE-2026-31861: Shell Command Injection in Git Routes [CloudCLI UI]

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash. This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint. This vulnerability is fixed in 1.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31861

CVE-2026-31861:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@siteboon/claude-code-ui	npm	<= 1.23.0	1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic command injection issue stemming from the use of child_process.exec (wrapped in a promise as execAsync) to execute git commands. Multiple API endpoints throughout server/routes/user.js and server/routes/git.js construct shell commands by directly embedding user-controlled input from request bodies and query parameters (e.g., gitName, gitEmail, file, branch, message).

The developers attempted to mitigate this by escaping double quotes, but this is insufficient as other shell metacharacters (like $() and backticks for command substitution) are still processed by the shell (/bin/sh by default in exec). This allows an attacker to inject and execute arbitrary commands on the server under the privileges of the Node.js process.

The patch addresses the root cause by replacing all instances of the unsafe execAsync with a new spawnAsync helper function. This new function uses child_process.spawn, which does not invoke a shell. Instead, it passes the command and its arguments as an array, effectively preventing any user-supplied data from being interpreted as shell commands. The widespread replacement of execAsync across numerous routes in the fixing commit indicates that the command injection vulnerability was systemic in the application's handling of git operations.

Vulnerable functions

router.post('/git-config')

server/routes/user.js

The function constructs a shell command using user-provided `gitName` and `gitEmail` values. It uses `execAsync`, which internally uses `child_process.exec`, to execute the command. The input is not properly sanitized, allowing shell metacharacters like `$(...)` or backticks to be interpreted, leading to arbitrary command injection. The vulnerable code is executed within the POST request handler for the '/git-config' route.

router.get('/diff')

server/routes/git.js

The function takes a 'file' parameter from the user request and includes it in a shell command executed via `execAsync`. An attacker can provide a malicious file path containing shell metacharacters to execute arbitrary commands on the server. The vulnerable code is part of the GET request handler for the '/diff' route.

router.get('/file-with-diff')

server/routes/git.js

Similar to the '/diff' route, this function is vulnerable to command injection through the 'file' parameter, which is incorporated into a command string passed to `execAsync`. The vulnerable code is part of the GET request handler for the '/file-with-diff' route.

router.post('/commit')

server/routes/git.js

The function uses the user-provided 'message' from the request body to construct a git commit command. This message is not sanitized and is passed to `execAsync`, allowing an attacker to inject shell commands within the commit message. The vulnerable code is part of the POST request handler for the '/commit' route.

router.post('/checkout')

server/routes/git.js

The function takes a 'branch' name from the user and uses it to construct a 'git checkout' command. This input is passed to `execAsync` without proper sanitization, creating a command injection vulnerability. The vulnerable code is part of the POST request handler for the '/checkout' route.

router.post('/create-branch')

server/routes/git.js

This function is vulnerable to command injection via the 'branch' parameter, which is used to create a new git branch. The unsanitized input is passed to `execAsync`, allowing for arbitrary command execution. The vulnerable code is part of the POST request handler for the '/create-branch' route.

router.get('/commit-diff')

server/routes/git.js

The function is vulnerable to command injection through the 'commit' parameter from the user request. The value is directly embedded in the command string for `execAsync` without quoting or sanitization, allowing for arbitrary command execution. The vulnerable code is part of the GET request handler for the '/commit-diff' route.

router.post('/publish')

server/routes/git.js

The function is vulnerable to command injection via the 'branch' parameter. The user-supplied branch name is used to construct a 'git push' command that is executed by `execAsync`, which can be exploited by providing malicious input. The vulnerable code is part of the POST request handler for the '/publish' route.

router.post('/discard')

server/routes/git.js

This function is vulnerable to command injection through the 'file' parameter. The unsanitized file path is used in a command passed to `execAsync`, allowing an attacker to execute arbitrary commands. The vulnerable code is part of the POST request handler for the '/discard' route.

router.post('/delete-untracked')

server/routes/git.js

Similar to the '/discard' route, this function is vulnerable to command injection via the 'file' parameter. The unsanitized input is used in a command executed by `execAsync`, leading to a security risk. The vulnerable code is part of the POST request handler for the '/delete-untracked' route.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.