CVE-2026-73222

npm/claude-code-templates CVE-2026-73222: high 8.8, EPSS 0.32%

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Action: Upgrade claude-code-templates to 1.29.4 or later.

npm i claude-code-templates@1.29.4

Affected

Fixed versions

Sources

• osv: GHSA-79wm-x847-7cvg
• https://github.com/davila7/claude-code-templates/security/advisories/GHSA-79wm-x847-7cvg
• https://nvd.nist.gov/vuln/detail/CVE-2026-73222
• https://github.com/davila7/claude-code-templates/commit/bc4618b07232633c1c0aac12a43e436268d31783
• https://github.com/davila7/claude-code-templates
• https://github.com/davila7/claude-code-templates/blob/main/CHANGELOG.md

CVE-2026-73222 · published 2026-09-03T19:50:47Z · modified 2026-09-03T20:00:04.931402692Z · JSON