Anthropic Claude Code CLI and Claude Agent SDK expose a prompt editor function that builds shell commands with file paths supplied by the user. By inserting shell metacharacters such as $() or backticks into these paths, an attacker can cause the underlying execSync call to perform command substitution and execute arbitrary shell commands. The vulnerability allows full control of the operating system with the same privileges as the user running the CLI, enabling credential theft, data exfiltration or further system compromise.

The flaw affects the Anthropic Claude Agent SDK for Python and the Anthropic Claude Code CLI. All publicly released versions prior to the fix are vulnerable; the vendor has not listed specific version ranges, so users of any older releases should consider themselves at risk.

The CVSS score of 8.4 indicates high severity. Although EPSS data is not available, the attack requires only that an attacker can run the CLI on a target machine, a common scenario in CI/CD pipelines or local development environments. The vulnerability is not yet listed in CISA’s KEV catalog, but the potential for remote code execution in automated workflows makes it a prime target for exploitation. Both the scope and impact emphasize local code execution that can lead to full system compromise if the user has elevated rights.