{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-35021/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-35021"}],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["cve-2026-35021","command-injection","anthropic"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Anthropic Claude Code CLI and Claude Agent SDK are susceptible to an OS command injection vulnerability, as detailed in CVE-2026-35021. This flaw stems from the insufficient sanitization of file paths within the prompt editor invocation utility. An attacker can exploit this vulnerability by injecting shell metacharacters into file paths, which are then interpolated into shell commands executed using \u003ccode\u003eexecSync\u003c/code\u003e. The use of double quotes around the file path does not prevent command substitution, enabling attackers to execute arbitrary commands with the privileges of the user running the CLI, creating a high-risk scenario for compromised systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious file path containing shell metacharacters (e.g., \u003ccode\u003e$()\u003c/code\u003e, backticks).\u003c/li\u003e\n\u003cli\u003eThe malicious file path is provided as input to the Anthropic Claude Code CLI or Agent SDK, specifically targeting the prompt editor invocation utility.\u003c/li\u003e\n\u003cli\u003eThe application interpolates the attacker-controlled file path into a shell command.\u003c/li\u003e\n\u003cli\u003eThe shell command, now containing the injected payload, is executed via the \u003ccode\u003eexecSync\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe shell interprets the injected metacharacters, triggering command substitution.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s injected commands are executed with the privileges of the user running the CLI or SDK.\u003c/li\u003e\n\u003cli\u003eThe attacker gains arbitrary code execution on the system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows attackers to execute arbitrary commands on the affected system. This could lead to complete system compromise, data exfiltration, or deployment of malicious payloads such as ransomware. Due to the nature of the vulnerability, any system utilizing the Claude Code CLI or Agent SDK is potentially at risk if it processes untrusted file paths.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Suspicious Claude CLI/Agent SDK Command Execution\u003c/code\u003e to identify potential command injection attempts via process creation logs.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for command line arguments containing shell metacharacters being passed to processes spawned by the Claude CLI or Agent SDK using the \u003ccode\u003eProcess Creation with Shell Metacharacters\u003c/code\u003e Sigma rule.\u003c/li\u003e\n\u003cli\u003eApply any available patches or updates released by Anthropic to address CVE-2026-35021 once they are available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-06T20:16:25Z","date_published":"2026-04-06T20:16:25Z","id":"/briefs/2026-04-claude-code-cmd-injection/","summary":"The Anthropic Claude Code CLI and Claude Agent SDK are vulnerable to OS command injection via crafted file paths, allowing arbitrary command execution.","title":"Anthropic Claude Code CLI/Agent SDK OS Command Injection Vulnerability (CVE-2026-35021)","url":"https://feed.craftedsignal.io/briefs/2026-04-claude-code-cmd-injection/"}],"language":"en","title":"CraftedSignal Threat Feed — Cve-2026-35021","version":"https://jsonfeed.org/version/1.1"}