The vulnerability is an unauthenticated operating‑system command injection in the Claude Code Studio server. By sending crafted POST requests to the /api/execute or /api/install-agent endpoints, an attacker can inject shell commands through the prompt or agentName parameters. The injected input is passed to child_process.spawn() with shell enabled, allowing arbitrary commands to run with the privileges of the host system. This flaw results in full compromise of source code, credentials, and any sensitive data stored locally.

The issue affects the Claude Code Templates CLI tool distributed by davila7. Versions prior to 1.29.4 are vulnerable; the fix was applied in release 1.29.4.

The CVSS score of 8.8 classifies it as high severity, but the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable service by contacting port 3444 directly or by tricking a developer running the Studio into visiting a malicious webpage that triggers the vulnerable API calls. Because the server listens on all interfaces and accepts unauthenticated requests, a remote attacker with network access can exploit the flaw immediately, leading to system compromise.