650 matches found
deep-code-security
deep-code-security Multi-language Static Application Security...
Command Injection
Overview @siteboon/claude-code-ui is an A web-based UI for Claude Code CLI Affected versions of this package are vulnerable to Command Injection through the authenticateWebSocket process and unsanitized input in the WebSocket shell handler. An attacker can execute arbitrary operating system...
GHSA-GV8F-WPM2-M5WR @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection Download: cveclaudecodeuisubmissionv2.zip Submission Info | Field | Value | |-------|-------| | Package | @siteboon/claude-code-ui | | Ecosystem | npm | | Affected versions | =...
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection Download: cveclaudecodeuisubmissionv2.zip Submission Info | Field | Value | |-------|-------| | Package | @siteboon/claude-code-ui | | Ecosystem | npm | | Affected versions | =...
EUVD-2026-11265
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters...
GHSA-F2FC-VC88-6W7Q @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
Summary Multiple Git-related API endpoints use execAsync with string interpolation of user-controlled parameters file, branch, message, commit, allowing authenticated attackers to execute arbitrary OS commands. Details The claudecodeui application provides Git integration through various API...
Arbitrary Code Injection
Overview @siteboon/claude-code-ui is an A web-based UI for Claude Code CLI Affected versions of this package are vulnerable to Arbitrary Code Injection in the git-config endpoint due to improper sanitization of user-supplied input in shell command construction. An attacker can execute arbitrary O...
Exploit for Code Injection in Anthropic Claude_Code
Claude Code: MCP Tool Confirmation Prompt Misrepresentation !...
Fake Claude Code install pages hit Windows and Mac users with infostealers
Attackers are cloning install pages for popular tools like Claude Code and swapping the “one‑liner” install commands with malware, mainly to steal passwords, cookies, sessions, and access to developer environments. Modern install guides often tell you to copy a single command like curl...
Exploit for Code Injection in Anthropic Claude_Code
CVE-2025-59536 - the startup trust dialog implementation. Clau...
Exploit for Code Injection in Anthropic Claude_Code
CVE-PENDING: MCP Tool Confirmation Prompt Misrepresentation in...
Exploit for OS Command Injection in Anysphere Cursor
CVE PoC: MCP Server Config Swap in Claude Code Vulnerabilit...
CISOs in a Pinch: A Security Analysis of OpenClaw
Learn how Claude Code Security set Cybersecurity stocks on fire...
Claude Code Security set the Cybersecurity Stocks on Fire - Here's the Signal in the Smoke
Learn how Claude Code Security set Cybersecurity stocks on fire...
Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration
Cybersecurity researchers have disclosed multiple security vulnerabilities in Anthropic's Claude Code, an artificial intelligence AI-powered coding assistant, that could result in remote code execution and theft of API credentials. "The vulnerabilities exploit various configuration mechanisms,...
PT-2026-22051
Name of the Vulnerable Software and Affected Versions claude-hovercraft affected versions not specified Description The software contains an executeClaudeCode command injection issue that can lead to remote code execution. The issue is related to the executeClaudeCode function. This allows for th...
Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning
Artificial intelligence AI company Anthropic has begun to roll out a new security feature for Claude Code that can scan a user's software codebase for vulnerabilities and suggest patches. The capability, called Claude Code Security , is currently available in a limited research preview to...
Command Validation Bypass
@anthropic-ai/claude-code is vulnerable to command validation bypass. The vulnerability is due to improper validation of piped sed operations with the echo command, which allows an attacker to bypass file write restrictions and write to sensitive directories when the “accept edits” feature is...
Hobby coder accidentally creates vacuum robot army
Sammy Azdoufal wanted to steer his robot vacuum with a PS5 controller. Like any good maker, he thought it would be fun to drive a new DJI Romo around manually. He ended up gaining access to an army of robotic cleaners that gave him eyes into thousands of homes. Driven by purely playful reasons,...