CVE-2026-31975 is a critical OS command injection in Cloud CLI, also known as Claude Code UI, scored 9.8. Values from a WebSocket message went into a bash command without sanitizing. Upgrade the npm package @siteboon/claude-code-ui to 1.25.0 or later. Details and checks follow.
What's affected
The npm package @siteboon/claude-code-ui at version 1.24.0 and earlier. The fixed version is 1.25.0.
The project is a desktop and mobile interface for coding agent command line tools. It runs a shell on the machine where it is installed, so the stakes are those of a remote shell.
The GitHub advisory also describes related weaknesses, an insecure default signing secret and a gap in WebSocket authentication, that make the injection reachable without credentials on a default setup. The submitter's text describes them as chained.
How to check if you're exposed
npm ls @siteboon/claude-code-ui
npm ls -g @siteboon/claude-code-ui
The first checks a project, the second a global install. Anything at 1.24.0 or older needs the upgrade.
Then check where the service listens. A UI that is bound only to localhost is a different case from one published on a LAN address or the internet. Review how it was started and whether a JWT secret was set explicitly.
What to do now
- Upgrade to @siteboon/claude-code-ui 1.25.0 or later and restart the service.
- Make sure no instance is reachable from the internet. Put it behind a VPN or an authenticating proxy.
- Set an explicit, random JWT secret instead of relying on any default.
- If an older instance was exposed, review the host for unexpected commands, new files and outbound connections, and rotate credentials stored on it, including API keys for coding tools.
- Run such tools as a low privilege user, ideally in a container.
Why it matters
The class is CWE-78, OS command injection. The projectPath and initialCommand values from a WebSocket message were placed into a bash command string without sanitizing, and the advisory says a session id offered a second path.
Tools that bring coding agents to the browser need strong authentication, because they sit very close to source code, tokens and the shell. When the login is weak or has a default secret, the web UI becomes a remote shell for whoever reaches the port.
The advisory text says the researcher reported the issue privately and disclosed it publicly after a 90 day period. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Does this affect the coding agents themselves?
The advisory concerns the web UI package, not the agents it can launch.
I only run it on localhost. Should I still upgrade?
Yes. Local only reduces exposure, but other software on the same machine, or a browser page, may still reach a local port.
Sources
Last reviewed: 19 October 2026.
