Approved changes feed: RSS · Atom
cpe:2.3:a:cloudcli:cloud_cli:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cloudcli (ed5b8eb8-e5c5-5863-a761-c4c57c7699d5) |
|---|---|
| Product | Cloud Cli (15b988ec-7eb7-5550-ba6b-866c8cd09f5e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-31975 |
vulnerable | 2026-06-08 07:57:16.175843 |
Cloud CLI WebSocket shell injection
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.
Published: 2026-03-11T17:27:06.111Z
Updated: 2026-03-12T14:05:01.389Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31862 |
vulnerable | 2026-06-08 07:57:16.007765 |
Cloud CLI has Command Injection via Multiple Parameters
CRITICAL (9.1)
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands. This vulnerability is fixed in 1.24.0.
Published: 2026-03-11T17:17:47.941Z
Updated: 2026-03-12T14:22:04.149Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31861 |
vulnerable | 2026-06-08 07:57:16.007135 |
Shell Command Injection in Git Routes [CloudCLI UI]
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash. This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint. This vulnerability is fixed in 1.24.0.
Published: 2026-03-11T17:22:10.111Z
Updated: 2026-03-12T14:07:17.766Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.