Cloudcli vulnerabilities
We track 3 vulnerabilities in Cloudcli products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 11, 2026.
Latest Cloudcli vulnerabilities
- 9.8 Critical severity
claudecodeui: Improper Neutralization of Special Elements used in an OS Command
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocke
- 8.8 High severity
claudecodeui: Improper Neutralization of Special Elements used in an OS Command
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, co
- 8.8 High severity
claudecodeui: Improper Control of Generation of Code
Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command s