A critical OS command injection vulnerability exists in the Anthropic Claude Code CLI and Claude Agent SDK, which could allow a local attacker to execute arbitrary system commands.

The vulnerability is an OS command injection flaw located within the command lookup helper and deep-link terminal launcher. Local attackers can trigger this by manipulating the TERMINAL environment variable to execute unauthorized commands.

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the privileges of the affected user. This could lead to a full compromise of the local development environment, unauthorized access to sensitive API keys or credentials stored within the CLI tools, and potential lateral movement into connected infrastructure. Given the CVSS score of 8.4, this represents a high-severity risk to development and operational integrity.

Immediate Action: Monitor official communication channels from Anthropic and apply security updates as soon as they are released for the Claude Code CLI and Agent SDK.

Proactive Monitoring: Review system and process logs for anomalous command executions or unexpected modifications to environment variables in development environments.

Compensating Controls: Restrict local user access to the affected machine and ensure that environment variables are not modifiable by untrusted processes or local low-privileged users.

Public Exploit Available: No

Organizations utilizing the Anthropic Claude Code CLI and Claude Agent SDK must prioritize this issue due to the potential for arbitrary command execution. Security teams should audit current deployments and ensure that all development environments remain isolated and monitored until an official patch is applied. Immediate remediation should be performed as soon as the vendor publishes the specific fixed versions.