{"action":"Upgrade @siteboon/claude-code-ui to 1.25.0 or later.","affected":[{"fixed":"1.25.0","introduced":"0"}],"component":"@siteboon/claude-code-ui","cve_ids":["CVE-2026-31975"],"ecosystem":"npm","epss":0.03493,"exploited":false,"fixed_versions":["1.25.0"],"ghsa_id":"GHSA-gv8f-wpm2-m5wr","id":"tcs_01M5KFSHKNXB5MAYG274A9ST5E","modified_at":"2026-03-13T10:56:23.916800Z","published_at":"2026-03-11T00:37:25Z","references":["https://osv.dev/vulnerability/GHSA-gv8f-wpm2-m5wr","https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr","https://nvd.nist.gov/vuln/detail/CVE-2026-31975","https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26","https://github.com/siteboon/claudecodeui","https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-gv8f-wpm2-m5wr","url":"https://osv.dev/vulnerability/GHSA-gv8f-wpm2-m5wr"}],"summary":"@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection"}