Executive brief
Anthropic's Claude Code CLI and Agent SDK, tools used by developers to integrate AI into coding workflows, contain a vulnerability that could allow for unauthorized command execution. An attacker with local access to a system could manipulate environment variables to run malicious code with the same permissions as the user of the CLI. While the vulnerability was officially rejected by the CVE authority because it requires pre-existing control over environment variables, it highlights a potential risk in how the tool handles system commands.
Technical details
The vulnerability is classified as OS Command Injection (CWE-78) within the command lookup helper and deep-link terminal launcher of Anthropic's Claude developer tools. The root cause is the use of shell=true when constructing and executing shell commands via /bin/sh, which fails to properly sanitize the TERMINAL environment variable. A local attacker can inject shell metacharacters into this variable to achieve arbitrary code execution with the privileges of the current user. The CVE was rejected by the CNA under the argument that controlling environment variables is equivalent to code execution and falls outside the threat model for CLI tools, though security researchers originally assigned it a high severity score.
Affected products
- Anthropic Claude Code CLI up to 2.1.91
- Anthropic Claude Agent SDK up to 0.1.55
Timeline
- 2026-04-06: disclosed: Initial disclosure by VulnCheck
- 2026-05-29: other: CVE rejected by CNA due to threat model dispute