CVE-2026-35021 | Anthropic Claude Code & Agent SDK OS Command Injection via promptEditor.ts

Exp

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the affected code path cannot be triggered through normal usage of Claude Code.

Published: 2026-04-06 Last update: 2026-05-29 Assigner: [email protected] Source: [email protected]

Conclusion & alert: This CVE is rejected; it is not tracked as an active vulnerability. Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Do not treat as an active exposure for patching queues—follow the CVE record status and authoritative vendor or program statements only.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2026-35021

EDB-ID Source Kind Published Link
nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2026-35021

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-04-07 0.03%

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-35021

CVSS metrics for this CVE.

No CVSS data in dataset for this CVE.

Weakness enumeration for CVE-2026-35021

Affected software / configurations for CVE-2026-35021

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-35021

URL Tags
No references in dataset.
cvelogic Threat Intelligence