Which versions of Claude Code are affected by CVE-2026-35020?

CVE-2026-35020 is a command injection vulnerability in Anthropic Claude Code CLI and Claude Agent SDK for Python that allows local attackers to execute arbitrary commands through environment variable…

Is there a public PoC exploit available for CVE-2026-35020?

Yes, a public proof-of-concept exploit is available for CVE-2026-35020. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-35020?

Within 24 hours: Identify all systems running Claude Code CLI or Claude Agent SDK for Python and document current versions in use; disable or restrict access to affected systems in CI/CD pipelines pending remediation. Within 7 days: Implement environment variable sanitization controls; isolate developer machines from untrusted processes that could set the TERMINAL variable; restrict TERMINAL variable modification through OS-level controls where feasible. Within 30 days: Monitor vendor advisories for patch availability and deploy immediately upon release; consider evaluating alternative tools if no patch timeline is provided by Anthropic.

Claude Code CVE-2026-35020

Q: What is the CVSS score of CVE-2026-35020?

CVE-2026-35020 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19438 HIGH

OS Command Injection (CWE-78)

2026-04-06 VulnCheck

Command Injection Claude Code Claude Agent Sdk For Python

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 19:30 euvd

EUVD-2026-19438

Analysis Generated

Apr 06, 2026 - 19:30 vuln.today

CVE Published

Apr 06, 2026 - 18:58 nvd

HIGH 8.6

DescriptionCVE.org

Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell metacharacters into the TERMINAL variable which are interpreted by /bin/sh when the command lookup helper constructs and executes shell commands with shell=true. The vulnerability can be triggered during normal CLI execution as well as via the deep-link handler path, resulting in arbitrary command execution with the privileges of the user running the CLI.

AnalysisAI

OS command injection in Anthropic Claude Code CLI and Claude Agent SDK for Python allows local attackers to execute arbitrary commands by poisoning the TERMINAL environment variable with shell metacharacters. The vulnerability affects both normal CLI operations and deep-link handlers, enabling privilege escalation to the user context running the CLI. Publicly available exploit code exists. With CVSS 8.6 (High) severity, this presents significant risk in CI/CD pipelines and developer environments where environment variables may be attacker-controlled.

Technical ContextAI

This vulnerability stems from CWE-78 (OS Command Injection) in the command lookup helper and deep-link terminal launcher components. The affected code constructs shell commands using shell=true in Python subprocess calls, passing unsanitized user-controlled input from the TERMINAL environment variable directly to /bin/sh. When the CLI needs to launch a terminal or execute commands, it reads the TERMINAL variable and concatenates it into a shell command string without proper escaping or validation. An attacker who can control environment variables-common in CI/CD systems, containerized environments, or shared developer workstations-can inject shell metacharacters (semicolons, pipes, backticks, command substitution operators) that break out of the intended command context and execute arbitrary code. The vulnerability exists in both cpe:2.3:a:anthropic:claude_code and cpe:2.3:a:anthropic:claude_agent_sdk_for_python, indicating the flaw is present in the core command execution logic shared across these developer tooling products. The deep-link handler path expands the attack surface beyond interactive CLI use to scenarios where malicious links could trigger exploitation.

RemediationAI

Immediate mitigation requires restricting control over the TERMINAL environment variable in environments running Claude Code CLI or Claude Agent SDK. In CI/CD systems, explicitly unset or validate the TERMINAL variable before executing Claude tooling, using allowlists of known-safe terminal emulator paths (e.g., /usr/bin/xterm, /usr/bin/gnome-terminal) and rejecting any values containing shell metacharacters. For containerized deployments, use readonly or restricted environment variable configurations. Organizations should monitor for vendor-released patches from Anthropic addressing the underlying shell=true subprocess invocation pattern-likely requiring migration to shell=false with proper argument list handling or implementing strict input validation and escaping for environment variable values passed to shell contexts. Until patches are available, consider disabling deep-link handler functionality if not required and running Claude tools in isolated, non-privileged containers with minimal environment variable exposure. Review CI/CD logs and developer workstation audit trails for suspicious TERMINAL variable values or unexpected command executions. Consult the Phoenix Security advisory at https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/ for detailed technical analysis and interim mitigation strategies. Upstream fix availability not independently confirmed from available data-monitor Anthropic security advisories and GitHub repositories for patch releases.