CVE-2026-31861 Details
Description
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash. This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint. This vulnerability is fixed in 1.24.0.
A shell command injection vulnerability has been identified in Cloud CLI versions prior to 1.24.0. The issue arises in the '/api/user/git-config' endpoint, which constructs shell commands by interpolating user-supplied 'gitName' and 'gitEmail' values into command strings executed by 'child_process.exec()'. While the input is enclosed in double quotes and only the quote character is escaped, this approach fails to properly sanitize backticks, command substitution, and certain escape sequences. As a result, authenticated attackers can execute arbitrary operating system commands through the git configuration endpoint. This vulnerability has been patched in version 1.24.0.
The vulnerability has been fixed in Cloud CLI version 1.24.0. Users should update to this version. The patch involves replacing the 'exec()' function with 'spawn()', which safely handles command arguments without using a shell, thereby preventing command injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siteboon/claudecodeui/security/advisories/GHSA-7fv4-fmmc-86g2 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/siteboon/claudecodeui/commit/86c33c1c0cb34176725a38f46960213714fc3e04 | [email protected] | Patch |
| https://github.com/siteboon/claudecodeui/releases/tag/v1.24.0 | [email protected] | Release Notes |
| https://github.com/siteboon/claudecodeui/security/advisories/GHSA-7fv4-fmmc-86g2 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cloudcli cloud cli | < 1.24.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | New CVE Received | [email protected] |