Anthropic — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/anthropic/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 06 Apr 2026 20:16:25 +0000Anthropic Claude Code CLI/SDK OS Command Injection Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-04-claude-command-injection/Mon, 06 Apr 2026 20:16:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-claude-command-injection/CVE-2026-35022 describes an OS command injection vulnerability in the Anthropic Claude Code CLI and Claude Agent SDK that allows attackers with control over authentication settings to execute arbitrary commands, potentially leading to credential theft and environment variable exfiltration.The Anthropic Claude Code CLI and Claude Agent SDK are vulnerable to OS command injection (CVE-2026-35022). This vulnerability stems from the insecure execution of authentication helper configuration values. Specifically, the application executes commands using shell=true without proper input validation on parameters such as apiKeyHelper, awsAuthRefresh, awsCredentialExport, and gcpAuthRefresh. An attacker who can manipulate these authentication settings can inject shell metacharacters to execute arbitrary commands with the privileges of the user or automation environment running the Claude CLI or SDK. This can lead to credential theft and the exfiltration of sensitive environment variables. Defenders should focus on detecting attempts to modify authentication settings or the execution of commands originating from the Claude CLI or SDK with suspicious arguments.

Attack Chain

  1. An attacker gains unauthorized access to the configuration settings of the Anthropic Claude Code CLI or Claude Agent SDK. This could be achieved through compromised credentials or a separate vulnerability.
  2. The attacker modifies the apiKeyHelper, awsAuthRefresh, awsCredentialExport, or gcpAuthRefresh parameters within the authentication configuration.
  3. The attacker injects shell metacharacters (e.g., ;, |, &&) into these parameters, crafting malicious commands.
  4. The Claude CLI or SDK attempts to authenticate, executing the configured helper command using shell=true.
  5. The injected shell metacharacters cause the operating system to execute the attacker’s malicious commands.
  6. The attacker’s commands steal credentials stored on the system.
  7. The attacker’s commands exfiltrate sensitive environment variables to an external server.
  8. The attacker uses the stolen credentials and environment variables to gain further access to the victim’s systems or data.

Impact

Successful exploitation of CVE-2026-35022 allows attackers to execute arbitrary commands on the system running the Anthropic Claude Code CLI or Claude Agent SDK. This can lead to the theft of sensitive credentials, such as API keys and AWS credentials, and the exfiltration of environment variables containing sensitive information. The impact includes unauthorized access to cloud resources, data breaches, and potential supply chain compromise if the compromised environment is used for software development or deployment. The scope of the impact depends on the permissions of the user or automation environment running the vulnerable software.

Recommendation

  • Monitor process execution for suspicious commands originating from the Claude CLI or SDK with command-line arguments containing shell metacharacters. Implement the Sigma rule “Detect Claude CLI/SDK Command Injection via Shell Metacharacters”.
  • Implement strict access control policies to limit who can modify the configuration settings of the Claude CLI or SDK.
  • Regularly audit the configuration settings of the Claude CLI or SDK for any unauthorized changes.
  • Patch CVE-2026-35022 as soon as a patch is available from Anthropic.
]]>criticaladvisorycommand-injectioncve-2026-35022anthropicclaudeAnthropic Claude Code CLI/Agent SDK OS Command Injection Vulnerability (CVE-2026-35021)https://feed.craftedsignal.io/briefs/2026-04-claude-code-cmd-injection/Mon, 06 Apr 2026 20:16:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-claude-code-cmd-injection/The Anthropic Claude Code CLI and Claude Agent SDK are vulnerable to OS command injection via crafted file paths, allowing arbitrary command execution.The Anthropic Claude Code CLI and Claude Agent SDK are susceptible to an OS command injection vulnerability, as detailed in CVE-2026-35021. This flaw stems from the insufficient sanitization of file paths within the prompt editor invocation utility. An attacker can exploit this vulnerability by injecting shell metacharacters into file paths, which are then interpolated into shell commands executed using execSync. The use of double quotes around the file path does not prevent command substitution, enabling attackers to execute arbitrary commands with the privileges of the user running the CLI, creating a high-risk scenario for compromised systems.

Attack Chain

  1. Attacker crafts a malicious file path containing shell metacharacters (e.g., $(), backticks).
  2. The malicious file path is provided as input to the Anthropic Claude Code CLI or Agent SDK, specifically targeting the prompt editor invocation utility.
  3. The application interpolates the attacker-controlled file path into a shell command.
  4. The shell command, now containing the injected payload, is executed via the execSync function.
  5. The shell interprets the injected metacharacters, triggering command substitution.
  6. The attacker’s injected commands are executed with the privileges of the user running the CLI or SDK.
  7. The attacker gains arbitrary code execution on the system.

Impact

Successful exploitation of this vulnerability allows attackers to execute arbitrary commands on the affected system. This could lead to complete system compromise, data exfiltration, or deployment of malicious payloads such as ransomware. Due to the nature of the vulnerability, any system utilizing the Claude Code CLI or Agent SDK is potentially at risk if it processes untrusted file paths.

Recommendation

  • Deploy the Sigma rule Detect Suspicious Claude CLI/Agent SDK Command Execution to identify potential command injection attempts via process creation logs.
  • Monitor process creation events for command line arguments containing shell metacharacters being passed to processes spawned by the Claude CLI or Agent SDK using the Process Creation with Shell Metacharacters Sigma rule.
  • Apply any available patches or updates released by Anthropic to address CVE-2026-35021 once they are available.
]]>highadvisorycve-2026-35021command-injectionanthropic