Threats Tagged 'cve-2026-73222'
View all threats tagged with 'cve-2026-73222'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-73222'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-73222: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in davila7 claude-code-templatesCVE-2026-73222 0 CVE-2026-73222 is an OS command injection vulnerability in the davila7 claude-code-templates CLI tool prior to version 1.29.4. The vulnerability arises because the Claude Code Studio server launched with the --studio option binds to all interfaces on port 3444, allows cross-origin requests, and requires no authentication. Specifically, attacker-controlled input fields in POST /api/execute and /api/install-agent endpoints are passed unsafely to child_process.spawn() with shell execution enabled, allowing arbitrary OS command execution. This can lead to compromise of source code, credentials, and local data if an attacker can access the port or trick a developer into visiting a malicious website. The issue is fixed in version 1.29.4. Join the discussion | CVE Database V5 | 08/11/2026, 18:27:09 UTC Added: 08/11/2026, 18:43:15 UTC |
Showing 1 to 1 of 1 result