CVE-2026-31861 is a high-severity shell command injection vulnerability impacting Cloud CLI (aka Claude Code UI) versions prior to 1.24.0. Authenticated attackers can exploit the /api/user/git-config endpoint, which insecurely interpolates user-supplied git configuration values, to execute arbitrary operating system commands. Rated 8.8 High on CVSS, it requires low privileges and has low attack complexity, leading to high impacts on confidentiality, integrity, and availability. While not yet in CISA's Known Exploited Vulnerabilities catalog and lacking public exploit code, it is identified on an internal "Hot List" and has garnered some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.24.0CPE matchmatch criteria | cpe:2.3:a:cloudcli:cloud_cli:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.