This vulnerability resides in the executeClaudeCode method of claude‑hovercraft. The method fails to validate a user‑supplied string before passing it to a system call, allowing an attacker to inject arbitrary commands. Because authentication is not required, any network user can trigger the flaw. The impact is remote code execution on the server running the claude‑hovercraft service, with the privileges of the service account, mapping to CWE‑78. An attacker could install malware, exfiltrate data, or pivot to other systems.

Affected vendors: claude‑hovercraft (product claude‑hovercraft). No exact version information is provided, so all releases containing the executeClaudeCode method may be vulnerable until a patch is issued.

The CVSS base score of 9.8 denotes critical severity, while the EPSS score of 2% indicates that automated exploitation is not widespread yet. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote and network‑based; an attacker can send a crafted request to the executeClaudeCode endpoint and force command execution without credentials.