CVE-2026-35022

9.8

CRITICAL CVSS 3.1

Anthropic Claude Code & Agent SDK OS Command Injection via Authentication Helper

Overview

Description

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavior is documented in Anthropic's claude -h output with an explicit warning that non-interactive mode should only be used in trusted directories, making this intended and described behavior rather than a vulnerability.

Details

INFO

Published Date :

April 6, 2026, 8:16 p.m.

Last Modified :

May 29, 2026, 6:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-35022 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Anthropic	claude_code
2	Anthropic	claude_agent_sdk

: Total Affected Vendor : 1 | Products : 2

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	83251b91-4cc7-4094-a5c7-464a1b83ea10
CVSS 3.1	CRITICAL	[email protected]
CVSS 3.1	CRITICAL	MITRE-CVE
CVSS 4.0	CRITICAL	83251b91-4cc7-4094-a5c7-464a1b83ea10
CVSS 4.0	CRITICAL	[email protected]

Solution

Sanitize all user-supplied authentication helper configuration values before execution.

Validate all input to authentication helper parameters.
Avoid using shell=true for executing helper commands.
Update to a patched version when available.

Public PoC/Exploit Available at Github

CVE-2026-35022 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

pjordann/malicious_test

Este es un repositorio para hacer pruebas de seguridad sobre la vulnerabilidad conocida CVE-2026-35022.

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : April 27, 2026, 10:26 a.m. This repo has been linked 1 different CVEs too.

enchanted-plugins/hydra

Claude Code plugin for real-time threat interception with secret scanning, vulnerability detection, and command blocking.

Shell Python Markdown

Updated: 1 month, 3 weeks ago

1 stars 0 fork 0 watcher

Born at : April 15, 2026, 7:03 p.m. This repo has been linked 12 different CVEs too.

nikhilvallishayee/duh

D.U.H. — D.U.H is a Universal Harness. Provider-agnostic AI coding agent.

Python Shell

Updated: 1 week, 3 days ago

40 stars 6 fork 6 watcher

Born at : April 6, 2026, 11:44 p.m. This repo has been linked 4 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-35022 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-35022 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Rejected by [email protected]

May. 29, 2026

Action	Type	Old Value	New Value

CVE Modified by [email protected]

May. 29, 2026

Action	Type	Old Value	New Value
Removed	Tag	VulnCheck: disputed
Changed	Description	Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without input validation. Attackers who can influence authentication settings can inject shell metacharacters through parameters like apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh to execute arbitrary commands with the privileges of the user or automation environment, enabling credential theft and environment variable exfiltration.	Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavior is documented in Anthropic's claude -h output with an explicit warning that non-interactive mode should only be used in trusted directories, making this intended and described behavior rather than a vulnerability.
Removed	CVSS V4.0	VulnCheck: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Removed	CVSS V3.1	VulnCheck: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Removed	CWE	VulnCheck: CWE-78
Removed	CPE Configuration	OR cpe:2.3:a:anthropic:claude_code::::::node.js:: versions up to (including) 2.1.91 cpe:2.3:a:anthropic:claude_agent_sdk::::::python:: versions up to (including) 0.1.55
Removed	Reference	VulnCheck: https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/
Removed	Reference	VulnCheck: https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-authentication-helper
Removed	Reference Type	VulnCheck: https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/ Types: Exploit, Third Party Advisory
Removed	Reference Type	VulnCheck: https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-authentication-helper Types: Third Party Advisory

Initial Analysis by [email protected]

Apr. 29, 2026

Action	Type	New Value
Added	CPE Configuration	OR cpe:2.3:a:anthropic:claude_code::::::node.js:: versions up to (including) 2.1.91 cpe:2.3:a:anthropic:claude_agent_sdk::::::python:: versions up to (including) 0.1.55
Added	Reference Type	VulnCheck: https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/ Types: Exploit, Third Party Advisory
Added	Reference Type	VulnCheck: https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-authentication-helper Types: Third Party Advisory

CVE Modified by [email protected]

Apr. 13, 2026

Action	Type	Old Value	New Value
Added	Tag		disputed

New CVE Received by [email protected]

Apr. 06, 2026

Action	Type	New Value
Added	Description	Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without input validation. Attackers who can influence authentication settings can inject shell metacharacters through parameters like apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh to execute arbitrary commands with the privileges of the user or automation environment, enabling credential theft and environment variable exfiltration.
Added	CVSS V4.0	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CWE	CWE-78
Added	Reference	https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/
Added	Reference	https://www.vulncheck.com/advisories/anthropic-claude-code-agent-sdk-os-command-injection-via-authentication-helper

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.