Executive brief
Anthropic's Claude Code CLI and Agent SDK, tools used by developers to interact with AI models, contained a vulnerability that could allow for unauthorized command execution. An attacker could potentially run malicious code on a user's machine by tricking them into using a specially crafted file path within the tool. While the vulnerability was identified, the CVE was later rejected because the specific code path was determined to be unreachable during normal operation.
Technical details
An OS command injection vulnerability exists in the prompt editor invocation utility of Anthropic Claude Code CLI and Claude Agent SDK. The flaw stems from the use of `execSync` to execute shell commands where file paths are interpolated into the command string. Although the paths are wrapped in double quotes, POSIX shell semantics allow for command substitution (e.g., using backticks or `$()`) within those quotes. A local attacker could achieve arbitrary command execution with the privileges of the user running the CLI by providing a malicious file path. Note: This CVE was rejected by the CNA as it was determined the affected code path cannot be triggered through normal usage.
Affected products
- Anthropic Claude Code CLI up to 2.1.91
- Anthropic Claude Agent SDK up to 0.1.55
Timeline
- 2026-04-06: disclosed
- 2026-05-29: other: CVE rejected by CNA