CVE-2026-35022: Anthropic Claude Code OS command injection in authentication helpers

CVE-2026-35022 · Severity: info · CVSS 9.8 · Published 2026-04-06

Anthropic's Claude Code CLI and Agent SDK are tools used by developers to integrate AI capabilities into their software and workflows. A vulnerability in how these tools handle authentication settings could allow an attacker to execute unauthorized commands on a user's system. This could lead to the theft of sensitive credentials, exposure of environment variables, and full compromise of the development or automation environment. Note: This vulnerability was later disputed and rejected by the CNA, as the behavior is considered documented functionality when used in untrusted directories.

Technologies: Anthropic Claude Agent SDK, Anthropic Claude Code CLI. Vendors: Anthropic.

Quick answers

Is CVE-2026-35022 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35022 being exploited in the wild.
How severe is CVE-2026-35022?
Informational severity, with a CVSS score of 9.8, published 6 April 2026.
Which products and versions are affected?
Anthropic Claude Agent SDK up to 0.1.55; Anthropic Claude Code CLI up to 2.1.91.
Is there a fix for CVE-2026-35022?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-35022 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35022?
Check whether you run Anthropic Claude Agent SDK or Anthropic Claude Code CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Anthropic Claude Code CLI (up to 2.1.91) and Claude Agent SDK (up to 0.1.55) are susceptible to OS command injection (CWE-78). The root cause is the use of 'shell=true' during the execution of authentication helper configuration values without sufficient input validation. An attacker who can influence authentication settings—specifically parameters like apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh—can inject shell metacharacters. This allows for arbitrary command execution with the privileges of the current user or the automation environment. Although initially assigned a high CVSS score, the CVE was subsequently rejected by the CNA because the behavior is documented in the help output, which warns that non-interactive mode should only be used in trusted directories.

Affected products

  • Anthropic Claude Code CLI up to 2.1.91
  • Anthropic Claude Agent SDK up to 0.1.55

Timeline

  • 2026-04-06: disclosed: Initial vulnerability report published by VulnCheck.
  • 2026-04-13: other: Vulnerability marked as disputed.
  • 2026-05-29: other: CVE rejected by the CNA.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.