Threats affecting pkg:brew/claude-code-templates

Claude Code Studio server (part of claude-code-templates) versions >=1.27.0 and <1.29.4 contain an unauthenticated remote code execution vulnerability. The server listens on all interfaces without authentication and allows cross-origin POST requests. Two POST endpoints pass attacker-controlled input directly into shell commands with shell: true, enabling arbitrary OS command execution by unauthenticated attackers who can reach the server port. This can lead to full compromise of the developer's user account.