# Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Claude Code Studio's unauthenticated Express server binds 0.0.0.0 with wildcard CORS and passes request fields to spawn with shell:true, enabling drive-by and LAN RCE.

- Payout: Research
- Severity: high
- Program: Anthropic
- Found by: spartan8806
- Disclosed: 2026-09-03
- CVE: CVE-2026-73222
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-79wm-x847-7cvg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-79wm-x847-7cvg
- Tags: area:web domain:oss domain:web impact:rce kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:auth-bypass vuln:command-injection vuln:cors vuln:rce

**Target:** Express HTTP server (sandbox-server.js) on port 3444, /api/execute and /api/install-agent endpoints
**Root cause:** spawn(cmd, argsArray, {shell:true}) joins argv into a single sh -c string, so unvalidated request-body fields (prompt, agentName) are shell-parsed; combined with no auth, 0.0.0.0 binding and wildcard CORS.
**Steps:**
1. Victim runs `npx claude-code-templates --studio`, server listens on 0.0.0.0:3444 with `Access-Control-Allow-Origin: *` and no auth.
2. Attacker sends `curl -s -X POST http://127.0.0.1:3444/api/execute -H 'Content-Type: application/json' --data '{"prompt":"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF","mode":"local"}'` (10-char padding satisfies length check, `;` starts injection).
3. Alternatively POST /api/install-agent with `{"agentName":"x; touch /tmp/CCT_AGENT_PROOF #"}`.
4. Verify marker files exist: `ls -la /tmp/CCT_RCE_PROOF /tmp/CCT_AGENT_PROOF`.
5. Drive-by variant: malicious page issues cross-origin fetch() with Content-Type application/json; wildcard CORS preflight returns 200 so the POST is delivered.
**How found:** Code review of sandbox-server.js: noticed app.listen without host argument, wildcard CORS middleware, missing auth, and spawn calls with shell:true receiving request-body fields; confirmed at runtime on v1.28.13 (Node 22, Linux) with marker-file PoCs and an OPTIONS preflight from Origin: https://evil.example.
**Exploitation:** Unauthenticated attacker reaches port 3444 either directly on the LAN (server bound to 0.0.0.0) or via a malicious web page the developer visits, whose cross-origin JSON POST passes the wildcard CORS preflight. Injected shell metacharacters in prompt/agentName execute arbitrary commands with the developer's privileges, exposing source code, SSH keys, cloud credentials and .env secrets.
**Insight:** Local dev tooling that starts an HTTP server for a browser UI often binds 0.0.0.0 and sets ACAO:* for convenience; grep such tools for `shell: true` spawns fed by request bodies — the wildcard CORS turns any visited web page into a drive-by RCE vector, no LAN access needed.