CVE-2026-35020 - Vulnerability Analysis

Overview

Anthropic Claude Code CLI and Claude Agent SDK contain a command injection caused by improper handling of the TERMINAL environment variable in the command lookup helper and deep-link terminal launcher, letting local attackers execute arbitrary commands with user privileges, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary commands with the privileges of the user running the CLI, potentially leading to full system compromise.

Mitigation

Update to the latest version with the vulnerability fixed.

References

• https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/
• https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-terminal-environment-variable

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner