An OS command injection vulnerability exists in the Cloud CLI (Claude Code UI) application before version 1.25.0. The server component builds a bash command string by directly inserting the WebSocket message fields projectPath and initialCommand, without sanitizing user input. An attacker able to send crafted WebSocket messages can execute arbitrary shell commands on the server, leading to full compromise of the host. Additionally, the sessionId field is unsanitized, providing a secondary injection vector that can also be leveraged by an attacker.

All deployments of the Siteboon Claude Code UI (Cloud CLI) desktop and mobile client earlier than version 1.25.0 are affected. The flaw resides in the server/index.js module that processes WebSocket shell requests, meaning any instance exposing this endpoint to a network can be compromised.

The vulnerability carries a CVSS score of 8.7, indicating high severity, while the EPSS score is below 1 %, suggesting a currently low exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires network access to the Cloud CLI server and the ability to send WebSocket shell messages; given the unsanitized fields, a remote attacker could gain full system control. The issue was fixed in version 1.25.0, eliminating both the primary and secondary injection vectors.