The vulnerability exists in the authentication helper of Anthropic Claude Code CLI and Claude Agent SDK for Python. The helper executes configuration values with shell=True and performs no input validation. When an attacker can influence authentication settings, they can insert shell metacharacters into parameters such as apiKeyHelper, awsAuthRefresh, awsCredentialExport, or gcpAuthRefresh, allowing arbitrary shell commands to run with the privileges of the user or automation environment, leading to credential theft and exfiltration of environment variables.

The affected products are Anthropic Claude Code CLI and Anthropic Claude Agent SDK for Python. No specific product versions are provided, so all recent releases that include the authentication helper are potentially impacted.

The CVSS score of 9.3 indicates a severe risk. While EPSS data is unavailable and the vulnerability is not listed in the KEV catalog, the lack of input validation and ability to execute arbitrary commands make it highly valuable to attackers. Exploitation requires the ability to modify authentication helper settings, which could be achieved through compromised credentials or privileged access to configuration files. Once an attacker controls the input, they can run arbitrary commands with elevated privileges.