Three CVEs in Claude Code CLI: Shell Injection to Exfiltration

Claude Code leak to vulnerability Three CVEs in Claude Code CLI and the Chain That Connects Them

Claude Code Leak led to the discovery and registration of 3 CVEs: CVE-2026-35020, CVE-2026-35021, and CVE-2026-35022, which share a single root cause. They chain into credential exfiltration via HTTP and are exploitable on v2.1.91, validated on April 3, 2026. This article focuses on the chaining vulnerability.

Key Takeaways

• CVE-2026-35022 (auth helper injection) confirmed through four escalating PoC variants.
• CVE-2026-35020 (command lookup injection) enables arbitrary command execution with no user interaction.
• CVE-2026-35021 (editor path injection) exploits POSIX shell behavior.
• The three sinks chain: CVE-2026-35020 establishes execution, CVE-2026-35022 exfiltrates credentials.
• Validation on v2.1.91 confirmed that the vulnerability remains unpatched.
• Anthropic closed both CVE-2026-35020 and CVE-2026-35022 as “Informative,” highlighting the lack of protections.

1. Background: The Source Leak and What It Exposed

On March 31, 2026, a source map file (cli.js.map) shipped with Claude Code v2.1.88, mapping back to its original TypeScript source, comprising over 512,000 lines across 1,900 files. The source code was quickly analyzed by Phoenix Security, revealing command injection vulnerabilities that were reported shortly thereafter. This article focuses on the implications of the source leak rather than the leak itself.

2. The Vulnerability Overview

All CVEs share a root cause: unsanitized string interpolation into shell-evaluated execution. This represents a critical vulnerability (CWE-78) that has appeared on various “most dangerous” lists.

How we found those vulnerabilities

Static code analysis revealed over 100 findings, which were triaged using Phoenix Purple code Graph Navigator. The assessment confirmed the presence of three command injection sinks which were reported to Anthropic.

3. The effect of chaining all the vulnerabilities together

Each CVE is exploitable independently, but when chained, they enable credential theft and CI/CD exfiltration.

CVE-2026-35020 allows an attacker to write a malicious .claude/settings.json and CVE-2026-35022 exfiltrates sensitive data during the next authentication cycle. The fail-open sandbox default removes any security containment.

CVE-2026-35021 provides an alternative vector through file path execution in the editor.

CVE-2026-35020: Zero-Interaction Command Execution via Environment Variable

Shell commands are constructed without sanitization. The attacker must control the TERMINAL environment variable.

CVE-2026-35021: POSIX Shell Double-Quote Bypass via File Path

Exploits the fact that special characters retain significance inside double quotes in shell commands.

4. CVE-2026-35022: Modes of Exploitation

This CVE offers four modes of exploitation, allowing remote exfiltration of CI/CD data and includes configurations executed by execa.

• Mode 1: Local Marker (Shell Command Chaining) Executed commands are invisible outside of auth checks.
• Mode 2: Credential-Format Evasion The output masquerades as valid credentials while executing side-effect commands.
• Mode 3: HTTP Callback Exfiltration Sensitive data is sent to an external endpoint via HTTP.

CI/CD Severity Escalation

In CI/CD setups, the CVSS score reaches 9.9 due to no user interaction needed for execution, emphasizing the need for thorough oversight during pipeline executions.

5. Anthropic's Response

Both relevant CVEs were closed as “Informative,” indicating a lack of urgency in addressing the vulnerabilities despite the risks highlighted.

6. Context: AI Coding Agents Are a Documented Attack Surface

The vulnerabilities found are part of a broader pattern affecting AI coding tools, demonstrating the operational significance of the injection vulnerabilities that compromise developer tools.

7. Practical Guidance

For teams running Claude Code:

• Set ANTHROPIC_API_KEY as an environment variable to bypass vulnerabilities.
• Review settings.json regularly for changes.
• Avoid using -p mode with untrusted contributions to your CI/CD pipelines.

Recommendations for Anthropic:

• Replace shell: true with shell: false and adopt structured execution.
• Implement thorough validation and logging mechanisms for helper executions.

Next Steps

1. Audit your CI/CD pipeline configurations immediately.
2. Monitor for patches and updates from Claude Code.
3. For security evaluations, include criteria on shell execution patterns and credential helper architectures.