Loading vulnerability…
TERMINAL Environment Variable Command Injection in Claude Code CLI and Claude Agent SDK (Rejected CVE)
CVE-2026-35020 is a rejected identifier originally assigned to an OS command injection issue in Anthropic Claude Code CLI and Claude Agent SDK. The reported issue involves the command lookup helper and deep-link terminal launcher passing values derived from the TERMINAL environment variable to a system shell with shell execution enabled. Shell metacharacters in an attacker-controlled value can consequently execute commands with the privileges of the user running the application. The CNA rejected the identifier because exploitation requires prior control of arbitrary environment variables, which it considers functionally equivalent to code execution and outside the threat model of CLI tools.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The reported behavior permits arbitrary command execution in the application's user context, potentially compromising data confidentiality, integrity, and availability within that account's access. It does not establish privilege escalation beyond that context. The CNA determined that the required environment-variable control already represents equivalent execution capability, so the identifier is rejected rather than recognized as an independent vulnerability.
If you can’t patch tonight, do this now.
Prevent untrusted inputs from controlling the application's launch environment, particularly TERMINAL. For automated workflows, use a controlled environment and prevent untrusted repository or pull request settings from overriding process environment variables. Restrict available credentials and execution privileges to limit the consequences of unexpected command execution.
Patch, then assume compromise.
Replace shell-interpreted command construction with direct process execution using a fixed executable and structured argument arrays, keeping environment-derived values out of shell command strings. No confirmed fixed release or vendor patch information is available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.