What happened
NVD published CVE-2026-73222 (CVSS 8.8, High) on 2026-08-11, confirming the missing-authentication/CSRF-to-RCE chain in the Studio server component used to configure and monitor Claude Code.
Why it matters
This is a CSRF-to-RCE pattern against a companion tool for one of the most widely used AI coding agents (Claude Code) — a malicious webpage visited by a developer running the Studio server could silently trigger arbitrary command execution on their machine.
Attack vector
The Claude Code Studio server launched by --studio binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication; the POST /api/execute endpoint allows any network-reachable or malicious-webpage-driven (via CORS) requester to trigger command execution.
Affected systems
Claude Code Templates (davila7/claude-code-templates) prior to 1.29.4
Mitigation
Upgrade to claude-code-templates >= 1.29.4; do not expose the --studio server to untrusted networks.