漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Anthropic Claude Code & Agent SDK OS Command Injection via TERMINAL Environment Variable
Vulnerability Description
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell metacharacters into the TERMINAL variable which are interpreted by /bin/sh when the command lookup helper constructs and executes shell commands with shell=true. The vulnerability can be triggered during normal CLI execution as well as via the deep-link handler path, resulting in arbitrary command execution with the privileges of the user running the CLI.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Claude Code CLI和Claude Agent SDK 操作系统命令注入漏洞
Vulnerability Description
Claude Code CLI和Claude Agent SDK都是Anthropic开源的产品。Claude Code CLI是一个命令行AI编码助手工具。Claude Agent SDK是一个AI编码助手开发者工具包。 Claude Code CLI和Claude Agent SDK存在操作系统命令注入漏洞，该漏洞源于命令查找助手和深层链接终端启动器中的操作系统命令注入，可能导致本地攻击者通过操纵TERMINAL环境变量执行任意命令。
CVSS Information
N/A
Vulnerability Type
N/A