CVE-2026-31862 Cloud CLI has Command Injection via Multiple Parameters
Authenticated attackers can execute arbitrary OS commands via Git-related API endpoints in Cloud CLI due to unsafe string interpolation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31862?
CVE-2026-31862 is a critical command injection vulnerability in siteboon claudecodeui, published on 11 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands. This vulnerability is fixed in 1.24.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-31862?
2 open source packages ship an affected version, including @siteboon/claudecodeui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@siteboon/claudecodeui npm | All versions | 1.24.0 |
@siteboon/claudecodeui npm | All versions | 1.24.0 |
Products include Cloudcli Cloud Cli.
How do I fix CVE-2026-31862?
Upgrade @siteboon/claudecodeui to 1.24.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-31862 being exploited?
There is no known exploitation of CVE-2026-31862 in the wild and no public exploit code.
Other vulnerabilities in siteboon claudecodeui
Sources
Also known as GHSA-f2fc-vc88-6w7q.