NPM: Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

NPM: Claude Code Templates: Unauthenticated OS command injection RCE in Claude Code Studio server --studio vulnerability discovered by ? in WordPress Npm claude-code-templates versions = 1.29.2...

CVE-2026-73222 Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

@extropolis/claudia (>=0.2.1, <=0.2.29) potentially affected by CVE-2026-69110 via opencode-studio-server (1.28.3)

opencode-studio-server NPM version 1.28.3 is affected by a known vulnerability. The following packages have a transitive dependency on opencode-studio-server and may be impacted: - @extropolis/claudia =0.2.1, =0.2.29 Source cves: CVE-2026-69110 Source advisory: MEND:CVE-2026-69110...

Woodwing Studio Server - Phpinfo Config Detection

Phpinfo Config file exposed in Woodwing Studio Server. !/usr/bin/env python3 -- coding: utf-8 -- """Phpinfo Config file exposed in Woodwing Studio Server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Woodwing Stud...

Woodwing Studio Server Panel - Detect

Detects Woodwing Studio Server Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Woodwing Studio Server Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Woodwing Studio Server Panel ...

Woodwing Studio Server - Git Config Detection

Woodwing Studio Server .git/config file exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Woodwing Studio Server .""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Woodwing Studio Server - Git Config Detection',...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

Write-what-where Condition

Overview @remotion/studio-server is a Run a Remotion Studio with a server backend Affected versions of this package are vulnerable to Write-what-where Condition via the file write process. An attacker can overwrite or create arbitrary files by sending specially crafted input to the application...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.17, <=0.1.24) +27 more potentially affected by CVE-2026-30121 via @remotion/studio-server (>=4.0.91, <=4.0.409)

@remotion/studio-server NPM version =4.0.91, =1.0.0, =0.1.17, =1.0.0, =1.0.0, =0.1.4, =0.1.3, =0.1.4, =0.1.0, =3.0.4, =4.0.91, =4.0.91, =4.0.91, =4.0.260, =1.0.0, =1.0.20 and more Source cves: CVE-2026-30121 Source advisory: SNYK:JS-REMOTIONSTUDIOSERVER-17817236...

Arbitrary Code Injection

Overview @remotion/studio-server is a Run a Remotion Studio with a server backend Affected versions of this package are vulnerable to Arbitrary Code Injection through the process responsible for handling remote inputs. An attacker can execute arbitrary code by sending specially crafted requests...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.17, <=0.1.24) +27 more potentially affected by CVE-2026-30120 via @remotion/studio-server (>=4.0.91, <=4.0.409)

@remotion/studio-server NPM version =4.0.91, =1.0.0, =0.1.17, =1.0.0, =1.0.0, =0.1.4, =0.1.3, =0.1.4, =0.1.0, =3.0.4, =4.0.91, =4.0.91, =4.0.91, =4.0.260, =1.0.0, =1.0.20 and more Source cves: CVE-2026-30120 Source advisory: SNYK:JS-REMOTIONSTUDIOSERVER-17817238...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +4 more potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0-m5, =4.2.3, =1.0.0-m5, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321388...