A critical vulnerability in the davila7 claude-code-templates CLI tool allows unauthenticated attackers to execute arbitrary operating system commands.

This flaw encompasses OS command injection (CWE-78), missing authentication for critical functions (CWE-306), and cross-site request forgery (CWE-352). These vulnerabilities allow a remote attacker to execute arbitrary commands on the underlying host, as the application fails to properly neutralize special elements and lacks sufficient authentication controls.

The CVSS score of 8.8 indicates a high-severity risk. A successful exploit could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the network. Because the tool is used for configuring and monitoring development workflows, its compromise directly threatens the integrity of the software development pipeline.

Immediate Action: Update the claude-code-templates CLI tool to version 1.29.4 or later immediately.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unusual CLI activity originating from the user account running the tool.

Compensating Controls: Restrict network access to the host running this tool using host-based firewalls to prevent unauthorized remote interaction until the update is applied.

Public Exploit Available: Unknown

Given the severity of potential OS command injection, immediate action is required. Organizations should prioritize updating all instances of claude-code-templates to version 1.29.4 to remediate the underlying flaws and prevent unauthorized system access.