CVE-2026-31975 Cloud CLI WebSocket shell injection
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-31975?
CVE-2026-31975 is a high-severity vulnerability in siteboon claudecodeui, published on 11 Mar 2026.
Official description
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-31975?
2 open source packages ship an affected version, including @siteboon/claude-code-ui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@siteboon/claude-code-ui npm | All versions | 1.25.0 |
@siteboon/claude-code-ui npm | All versions | 1.25.0 |
Products include Cloudcli Cloud Cli.
How do I fix CVE-2026-31975?
Upgrade @siteboon/claude-code-ui to 1.25.0 or later.
Is CVE-2026-31975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31975 exists.
Other vulnerabilities in siteboon claudecodeui
Sources
Also known as GHSA-gv8f-wpm2-m5wr.