Anthropic’s Claude Code CLI and Claude Agent SDK for Python contain an OS command injection flaw that is triggered by manipulating the TERMINAL environment variable. When the command lookup helper or deep‑link terminal launcher constructs and executes shell commands with /bin/sh, any shell metacharacters injected into TERMINAL are interpreted, allowing a local attacker to run arbitrary commands. The flaw is a classic CWE‑78 weakness and can lead to execution of shell commands with the privileges of the user running the CLI, potentially compromising credentials and system integrity.

The vulnerability affects all versions of Anthropic’s Claude Code CLI and the Claude Agent SDK for Python where the command lookup helper and deep‑link terminal launcher are present. No specific version numbers are listed, implying that all current releases are susceptible.

With a CVSS score of 8.6 the flaw is considered high severity. Exploitation requires local access sufficient to set environment variables before invoking the CLI or deep‑link handler, meaning any user with such access can mount a successful attack. The EPSS score is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, but the lack of a patch and the local nature of the attack suggest that organizations running these tools should treat the risk as serious and seek remediation promptly.