Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Summary npx claude-code-templates --studio launches "Claude Code Studio", an Express HTTP server cli-tool/src/sandbox-server.js, default port 3444 that binds to all interfaces 0.0.0.0, sets Access-Control-Allow-Origin: , and requires no authentication. Two POST endpoints pass attacker-controlled...