CVE-2026-35022: Anthropic Claude Code & Agent SDK OS Command Injection via Authentication Helper
Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavior is documented in Anthropic's claude -h output with an explicit warning that non-interactive mode should only be used in trusted directories, making this intended and described behavior rather than a vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35022?
CVE-2026-35022 is considered a high severity vulnerability due to the potential for OS command injection.
How do I fix CVE-2026-35022?
To fix CVE-2026-35022, ensure that the authentication helper does not use 'shell=true' in its configuration and implement proper input validation.
What software is affected by CVE-2026-35022?
CVE-2026-35022 affects Anthropic Claude Code CLI and Anthropic Claude Agent SDK.
What are the consequences of exploiting CVE-2026-35022?
Exploiting CVE-2026-35022 can lead to unauthorized execution of OS commands, potentially compromising system integrity.
How does CVE-2026-35022 occur?
CVE-2026-35022 occurs when configuration values in the authentication helper are executed in a shell without proper validation.