CVE-2026-35021: Anthropic Claude Code OS command injection in prompt editor

CVE-2026-35021 · Severity: info · CVSS 7.8 · Published 2026-04-06

Anthropic's Claude Code CLI and Agent SDK, tools used by developers to interact with AI models, contained a vulnerability that could allow for unauthorized command execution. An attacker could potentially run malicious code on a user's machine by tricking them into using a specially crafted file path within the tool. While the vulnerability was identified, the CVE was later rejected because the specific code path was determined to be unreachable during normal operation.

Technologies: Anthropic Claude Agent SDK, Anthropic Claude Code CLI. Vendors: Anthropic.

Quick answers

Is CVE-2026-35021 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35021 being exploited in the wild.
How severe is CVE-2026-35021?
Informational severity, with a CVSS score of 7.8, published 6 April 2026.
Which products and versions are affected?
Anthropic Claude Agent SDK up to 0.1.55; Anthropic Claude Code CLI up to 2.1.91.
Is there a fix for CVE-2026-35021?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-35021 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35021?
Check whether you run Anthropic Claude Agent SDK or Anthropic Claude Code CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the prompt editor invocation utility of Anthropic Claude Code CLI and Claude Agent SDK. The flaw stems from the use of `execSync` to execute shell commands where file paths are interpolated into the command string. Although the paths are wrapped in double quotes, POSIX shell semantics allow for command substitution (e.g., using backticks or `$()`) within those quotes. A local attacker could achieve arbitrary command execution with the privileges of the user running the CLI by providing a malicious file path. Note: This CVE was rejected by the CNA as it was determined the affected code path cannot be triggered through normal usage.

Affected products

  • Anthropic Claude Code CLI up to 2.1.91
  • Anthropic Claude Agent SDK up to 0.1.55

Timeline

  • 2026-04-06: disclosed
  • 2026-05-29: other: CVE rejected by CNA

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.