CVE-2026-35020 | Anthropic Claude Code/Claude Agent SDK for Python Environment Variable TERMINAL os command injection

A vulnerability has been found in Anthropic Claude Code and Claude Agent SDK for Python and classified as critical. The impacted element is an unknown function of the component Environment Variable Handler. Performing a manipulation of the argument TERMINAL results in os command injection.

This vulnerability is cataloged as CVE-2026-35020. The attack must be initiated from a local position. There is no exploit available.