Which versions of Claude Code are affected by CVE-2026-35022?

CVE-2026-35022 is a critical OS command injection vulnerability in Anthropic's Claude Code CLI and Agent SDK for Python that allows unauthenticated remote attackers to execute arbitrary commands in…

Is there a public PoC exploit available for CVE-2026-35022?

Yes, a public proof-of-concept exploit is available for CVE-2026-35022. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-35022?

Within 24 hours: Identify all systems running Claude Code CLI or Agent SDK for Python by scanning CI/CD configurations, deployment manifests, and development environments; isolate affected runners from production secrets and credential stores. Within 7 days: Implement network-level restrictions blocking these SDK versions from outbound command execution; apply mandatory code review gates for any automation using these tools; rotate all credentials that may have been exposed via CI/CD runners. Within 30 days: Monitor Anthropic advisories for patch release; develop migration plan to patched SDK version or alternative tools; conduct forensic audit of CI/CD logs for suspicious command execution patterns dating back 90 days.

Claude Code CVE-2026-35022

Q: What is the CVSS score of CVE-2026-35022?

CVE-2026-35022 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-19442 CRITICAL

OS Command Injection (CWE-78)

2026-04-06 VulnCheck

GHSA-479q-mw77-pmr5

Command Injection Claude Code Claude Agent Sdk For Python

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 19:30 euvd

EUVD-2026-19442

Analysis Generated

Apr 06, 2026 - 19:30 vuln.today

CVE Published

Apr 06, 2026 - 18:59 nvd

CRITICAL 9.3

DescriptionCVE.org

Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without input validation. Attackers who can influence authentication settings can inject shell metacharacters through parameters like apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh to execute arbitrary commands with the privileges of the user or automation environment, enabling credential theft and environment variable exfiltration.

AnalysisAI

OS command injection in Anthropic Claude Code CLI and Agent SDK for Python allows remote, unauthenticated attackers to execute arbitrary commands through unsanitized authentication helper parameters processed with shell=true. The vulnerability enables credential theft and environment variable exfiltration in CI/CD pipelines where these tools run with elevated automation privileges. Publicly available exploit code exists, creating immediate risk for organizations using these SDKs in automated workflows.

Technical ContextAI

This vulnerability stems from CWE-78 (OS Command Injection) in the authentication helper execution logic of both the Claude Code CLI (cpe:2.3:a:anthropic:claude_code) and Claude Agent SDK for Python (cpe:2.3:a:anthropic:claude_agent_sdk_for_python). The affected components execute authentication helper commands using Python's subprocess module with shell=true parameter, directly interpolating user-controllable configuration values including apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh without input sanitization. When shell=true is enabled, shell metacharacters such as semicolons, pipes, backticks, and command substitution operators are interpreted by the underlying shell, allowing attackers to break out of the intended command context. This design flaw is particularly dangerous in authentication workflows where external helper programs are invoked to retrieve credentials, as these execution paths typically run with the full privileges of the calling process. The vulnerability is exploitable wherever authentication configuration can be influenced, including through environment variables, configuration files, or API parameters in automated environments.

RemediationAI

Organizations should immediately audit all deployments of Anthropic Claude Code CLI and Claude Agent SDK for Python, particularly in CI/CD pipelines and automated environments. Primary mitigation requires upgrading to patched versions once released by Anthropic; monitor the vendor advisory at https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-authentication-helper for patch availability. Until patches are deployed, implement these interim controls: disable or remove authentication helper functionality if not operationally required; restrict configuration file permissions to prevent unauthorized modification of helper parameters; implement strict input validation on any authentication configuration sources; use application-level allowlisting to restrict which helper programs can be executed; isolate Claude SDK execution in containerized environments with minimal credential access; rotate all credentials that may have been exposed in affected environments; and monitor process execution logs for suspicious shell metacharacter patterns in authentication helper invocations. For critical environments, consider temporarily suspending use of these tools until vendor patches are confirmed and applied.