Home

Description

Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without input validation. Attackers who can influence authentication settings can inject shell metacharacters through parameters like apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh to execute arbitrary commands with the privileges of the user or automation environment, enabling credential theft and environment variable exfiltration.

PUBLISHED Reserved 2026-03-31 | Published 2026-04-06 | Updated 2026-04-13 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unknown

Any version
affected

Default status
unknown

Any version
affected

Credits

Francesco Cipollone finder

References

phoenix.security/...-code-cli-allow-credential-exfiltration/ technical-description exploit

www.vulncheck.com/...and-injection-via-authentication-helper third-party-advisory

cve.org (CVE-2026-35022)

nvd.nist.gov (CVE-2026-35022)

Download JSON