Vulnerability Description
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the prompt editor invocation utility that allows attackers to execute arbitrary commands by crafting malicious file paths. Attackers can inject shell metacharacters such as $() or backtick expressions into file paths that are interpolated into shell commands executed via execSync. Although the file path is wrapped in double quotes, POSIX shell semantics (POSIX §2.2.3) do not prevent command substitution within double quotes, allowing injected expressions to be evaluated and resulting in arbitrary command execution with the privileges of the user running the CLI.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Anthropic | Claude Agent Sdk | <= 0.1.55 |
| Anthropic | Claude Code | <= 2.1.91 |
Related Weaknesses (CWE)
References
- https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-cExploitThird Party Advisory
- https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-Third Party Advisory
FAQ
What is CVE-2026-35021?
CVE-2026-35021 is a vulnerability with a CVSS score of 7.8 (HIGH). Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the prompt editor invocation utility that allows attackers to execute arbitrary commands by crafting mal...
How severe is CVE-2026-35021?
CVE-2026-35021 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35021?
Check the references section above for vendor advisories and patch information. Affected products include: Anthropic Claude Agent Sdk, Anthropic Claude Code.