@siteboon/claude-code-ui में Git रूट में शेल कमांड इंजेक्शन भेद्यता है

The vulnerability lies within the /api/user/git-config endpoint, which constructs shell commands using user-supplied gitName and gitEmail values. Insufficient sanitization of these inputs allows an attacker to inject arbitrary commands into the shell execution. Successful exploitation could grant an attacker full control over the underlying server, enabling them to read sensitive files, modify system configurations, install malware, or pivot to other systems on the network. The CVSS score of 8.8 (High) highlights the significant risk, especially considering the potential for authentication bypass. This vulnerability shares similarities with other OS command injection flaws where improper input validation leads to arbitrary code execution.

Organizations using @siteboon/claude-code-ui in their Node.js applications, particularly those relying on JWT authentication for access control, are at risk. Development teams using this package in CI/CD pipelines or automated deployment systems are also vulnerable if they haven't implemented robust input validation. Shared hosting environments where multiple applications share the same server are especially susceptible, as a compromise of one application could lead to the compromise of others.

• nodejs / server:

ps aux | grep '/api/user/git-config' | grep -i 'gitName'| grep -i 'gitEmail'

• nodejs / server:

journalctl -u your-node-app -g 'api/user/git-config' --since "1 hour ago"

• generic web:

curl -I 'your-server.com/api/user/git-config?gitName=;ls' # Check for command execution in response headers

1. 2026-03-10Disclosure

   disclosure

2. 2026-03-10Patch

   patch

1. आरक्षित2026-03-09
2. प्रकाशित2026-03-10
3. संशोधित2026-03-13
4. EPSS अद्यतन2026-03-23

The primary mitigation is to immediately upgrade to @siteboon/claude-code-ui version 1.24.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. First, strictly validate and sanitize all user-supplied input to the /api/user/git-config endpoint, ensuring that gitName and gitEmail contain only expected characters. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious shell command characters. Review and restrict the permissions of the user account running the Node.js application to minimize the impact of a successful exploit. Monitor system logs for unusual command executions or suspicious activity related to the /api/user/git-config endpoint.