https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-27T21:55:09.406327+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/fkie_cve-2026-35021 fkie_cve-2026-35021 2026-10-27T21:55:09.407924+00:00

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority (CNA). It was determined that the affected code path cannot be triggered through normal usage of Claude Code.

 https://cve.radiocsirt.org/vuln/ghsa-72p2-f44p-v65f GHSA-72p2-f44p-v65f 2026-10-27T21:55:09.407971+00:00

Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the prompt editor invocation utility that allows attackers to execute arbitrary commands by crafting malicious file paths. Attackers can inject shell metacharacters such as $() or backtick expressions into file paths that are interpolated into shell commands executed via execSync. Although the file path is wrapped in double quotes, POSIX shell semantics (POSIX ยง2.2.3) do not prevent command substitution within double quotes, allowing injected expressions to be evaluated and resulting in arbitrary command execution with the privileges of the user running the CLI.