# CVE-2026-35020: Anthropic Claude Code CLI OS command injection in command lookup helper

Source: https://junglewise.ai/threats/cve-2026-35020-anthropic-claude-code-cli-os-command-injection-in-command-lookup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-35020 · Severity: info · CVSS 8.4 · Published 2026-04-06

Anthropic's Claude Code CLI and Agent SDK, tools used by developers to integrate AI into coding workflows, contain a vulnerability that could allow for unauthorized command execution. An attacker with local access to a system could manipulate environment variables to run malicious code with the same permissions as the user of the CLI. While the vulnerability was officially rejected by the CVE authority because it requires pre-existing control over environment variables, it highlights a potential risk in how the tool handles system commands.

Technologies: [Anthropic Claude Agent SDK](https://junglewise.ai/threats/technologies/claude-agent-sdk), [Anthropic Claude Code CLI](https://junglewise.ai/threats/technologies/claude-code-cli). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic).

## Quick answers

**Is CVE-2026-35020 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35020 being exploited in the wild.

**How severe is CVE-2026-35020?** Informational severity, with a CVSS score of 8.4, published 6 April 2026.

**Which products and versions are affected?** Anthropic Claude Agent SDK up to 0.1.55; Anthropic Claude Code CLI up to 2.1.91.

**Is there a fix for CVE-2026-35020?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-35020 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-35020?** Check whether you run Anthropic Claude Agent SDK or Anthropic Claude Code CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as OS Command Injection (CWE-78) within the command lookup helper and deep-link terminal launcher of Anthropic's Claude developer tools. The root cause is the use of shell=true when constructing and executing shell commands via /bin/sh, which fails to properly sanitize the TERMINAL environment variable. A local attacker can inject shell metacharacters into this variable to achieve arbitrary code execution with the privileges of the current user. The CVE was rejected by the CNA under the argument that controlling environment variables is equivalent to code execution and falls outside the threat model for CLI tools, though security researchers originally assigned it a high severity score.

## Affected products

- Anthropic Claude Code CLI up to 2.1.91
- Anthropic Claude Agent SDK up to 0.1.55

## Timeline

- 2026-04-06: disclosed: Initial disclosure by VulnCheck
- 2026-05-29: other: CVE rejected by CNA due to threat model dispute

## Related threats

- [Claude Agent SDK argument injection via resume option](https://junglewise.ai/threats/cve-2026-96620-claude-agent-sdk-argument-injection-via-resume-option-allows)
- [Anthropic Claude Code OS command injection in authentication helpers](https://junglewise.ai/threats/cve-2026-35022-anthropic-claude-code-os-command-injection-in-authentication)
- [Anthropic Claude Code OS command injection in prompt editor](https://junglewise.ai/threats/cve-2026-35021-anthropic-claude-code-os-command-injection-in-prompt-editor)