CVE-2026-73222

The most dangerous aspect of CVE-2026-73222 is not the RCE itself but the trust-model inversion it creates: a developer tool quietly transforms the developer's workstation into a network-accessible command execution service with no authentication, and the browser-based attack path means a malicious webpage can weaponise this without any network positioning. Claude Code Studio binds a local server to all interfaces on port 3444 by default. That port is not firewalled on most systems, so anyone who reaches it—locally or through a compromised network segment—gets code execution with the developer's full privileges. But the more insidious vector is the open CORS policy. A developer running Studio who visits a malicious page has already lost; the browser will cheerfully POST requests to localhost:3444, and because the developer context has access to source code, credentials, tokens, and often direct paths into CI/CD pipelines, the blast radius extends far beyond the compromised endpoint. The vulnerability chains through multiple entry points. The "prompt" field reaches executeLocalTask() while the "agentName" field reaches child_process.spawn(), and checkAndInstallAgent() creates a shared dangerous path through /api/execute. This suggests the agent field was treated as trusted across multiple contexts—a fingerprint of a tool that accreted features without anyone drawing an explicit trust boundary diagram. What matters now is whether 1.29.4 actually closes both triggers. If it added authentication to the HTTP endpoint but left CORS permissive, the network threat is mitigated but the browser trigger remains viable. The safest assumption is that any Claude Code Templates installation still running a version before 1.29.4 has an open RCE vector that any webpage can invoke. Treat every unpatched developer workstation as already compromised—the blast radius of a compromised dev machine includes repository credentials, cloud tokens, VPN access, and supply chain pivot points. Developer tooling has undergone a quiet architectural shift: tools that were once CLI wrappers are increasingly long-running network services with HTTP APIs, inheriting all the failure modes of network services while being designed by people who think of them as "just a local convenience." This CVE is the 2026 instalment of a pattern that predates containers and cloud dev environments—each time localhost gets treated as a trust boundary, something dangerous follows.

Reviewed through automated stages and approved by a human before publication.