CVE-2026-35022 | Anthropic Claude Code & Agent SDK OS Command Injection via Authentication Helper

Exp

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the -p flag behavior is documented in Anthropic's claude -h output with an explicit warning that non-interactive mode should only be used in trusted directories, making this intended and described behavior rather than a vulnerability.

Published: 2026-04-06 Last update: 2026-05-29 Assigner: [email protected] Source: [email protected]

Conclusion & alert: This CVE is rejected; it is not tracked as an active vulnerability. Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Do not treat as an active exposure for patching queues—follow the CVE record status and authoritative vendor or program statements only.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2026-35022

EDB-ID Source Kind Published Link
nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2026-35022

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-05-18 0.54% 0.60% +0.06%
2 2026-05-01 0.41% 0.54% +0.13%
3 2026-04-30 0.41%

Full EPSS history (5 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-35022

CVSS metrics for this CVE.

No CVSS data in dataset for this CVE.

Weakness enumeration for CVE-2026-35022

Affected software / configurations for CVE-2026-35022

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-35022

URL Tags
No references in dataset.
cvelogic Threat Intelligence