Home

Description

Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell metacharacters into the TERMINAL variable which are interpreted by /bin/sh when the command lookup helper constructs and executes shell commands with shell=true. The vulnerability can be triggered during normal CLI execution as well as via the deep-link handler path, resulting in arbitrary command execution with the privileges of the user running the CLI.

PUBLISHED Reserved 2026-03-31 | Published 2026-04-06 | Updated 2026-04-13 | Assigner VulnCheck




HIGH: 8.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unknown

Any version
affected

Default status
unknown

Any version
affected

Credits

Francesco Cipollone finder

References

phoenix.security/...-code-cli-allow-credential-exfiltration/ technical-description exploit

www.vulncheck.com/...ction-via-terminal-environment-variable third-party-advisory

cve.org (CVE-2026-35020)

nvd.nist.gov (CVE-2026-35020)

Download JSON