claude-code-templates --studio ships an unauthenticated RCE bound to 0.0.0.0 with CORS wide open

GitHub Security Advisories·high signalXBlueskyLinkedInCopy link

GHSA-79wm-x847-7cvg (high, published 2026-09-03) covers Claude Code Studio, the Express server started by `npx claude-code-templates --studio` on port 3444. It calls app.listen with no host argument so it binds all interfaces, sends Access-Control-Allow-Origin: *, requires no auth, and passes the `prompt` and `agentName` request-body fields into child_process.spawn with shell: true, so any LAN host or malicious web page the developer visits gets arbitrary OS command execution. Confirmed at runtime on v1.28.13; the only validation on `prompt` is a 10-character minimum length.