CVE-2026-31862: Command Injection Vulnerability in @siteboon/claude-code-ui
Summary
CVE-2026-31862: @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters. Affects @siteboon/claudecodeui versions < 1.24.0. Fixed in 1.24.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @siteboon/claude-code-ui package provides Git integration through various API endpoints, allowing users to perform Git operations such as committing changes, checking out branches, and viewing diffs. This package is designed for developers who require seamless interaction with Git repositories within their applications. However, it is vulnerable to command injection due to improper handling of user-controlled parameters, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from multiple Git-related API endpoints that utilize execAsync() with string interpolation of user-controlled parameters such as file paths, branch names, commit messages, and commit hashes. This allows authenticated attackers to execute arbitrary OS commands, leading to remote code execution, full server compromise, data exfiltration, and potential supply chain attacks. The application attempts to escape certain characters but fails to adequately protect against various shell metacharacters, making it easy for attackers to bypass these defenses.
How To Fix
Minimum fixed version
1.24.0
This is the first release that contains the fix.
npm install @siteboon/claudecodeui@1.24.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected API endpoints until the package is updated. Additionally, ensure that user inputs are sanitized and validated before being processed by the application.
Conclusion
The @siteboon/claude-code-ui package is vulnerable to command injection, which poses significant security risks. It is crucial to update to the patched version 1.24.0 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @siteboon/claudecodeui →
FAQ
CVE-2026-31862 is a critical command injection vulnerability found in the @siteboon/claude-code-ui package, allowing attackers to execute arbitrary OS commands.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signing up.
The potential impacts include remote code execution, full server compromise, data exfiltration, and supply chain attacks, which can lead to significant security breaches.
You can update the package by running the command: npm install @siteboon/claude-code-ui@1.24.0 in your terminal.
If immediate updates are not possible, consider implementing input validation and sanitization as a temporary measure to mitigate the risk of command injection.
