Threats tagged 'ghsa-f2fc-vc88-6w7q'

The @siteboon/claude-code-ui application had multiple Git-related API endpoints vulnerable to command injection due to unsafe use of execAsync() with user-controlled parameters. These parameters included file paths, branch names, commit messages, and commit hashes, which were interpolated directly into shell commands, allowing authenticated attackers to execute arbitrary OS commands. The vulnerability was fixed in version 1.24.0 by replacing execAsync() calls with spawnAsync() that safely passes arguments without shell interpretation and by adding strict input validation.