Remote Code Execution Vulnerability in Claude Code Templates by Davila7
CVE-2026-73222

8.8HIGH

Key Information:

Vendor

Davila7

Status
Claude-code-templates
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73222?

Claude Code Templates, a CLI tool for configuring and monitoring Claude Code, is vulnerable due to an insecure server configuration. Prior to version 1.29.4, the server permits cross-origin requests and binds to all interfaces on port 3444 without authentication. This exposes critical endpoints to potential attacks. Specifically, the POST /api/execute endpoint inadvertently allows user-supplied data to be passed to child processes with shell execution enabled. An attacker can exploit this by either accessing the port directly or misleading a developer to access a malicious site, resulting in arbitrary command execution with the developer's privileges. This can lead to a compromise of source code, sensitive credentials, and local data.

Affected Version(s)

claude-code-templates < 1.29.4

References

https://github.com/davila7/claude-code-templates/security...
x_refsource_CONFIRM
https://github.com/davila7/claude-code-templates/commit/b...
x_refsource_MISC
https://github.com/davila7/claude-code-templates/blob/mai...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.