CVE-2026-96620: Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

Q: Which applications are exposed to this issue?

Applications using the Python Claude Agent SDK before version 0.2.121 are exposed only if they pass untrusted input as the session ID supplied to the resume option. Applications that do not allow an attacker to control that value do not meet the stated exploitation condition.

Q: What does an attacker need to provide to exploit the flaw?

The attacker needs control of the resume session ID and must supply a value beginning with a dash so it is parsed as a Claude CLI flag. The described attack injects --mcp-config to configure a stdio MCP server and execute a command when the CLI starts.

Q: Does exploitation bypass SDK permission controls?

Yes. The injected stdio MCP server command executes at Claude CLI startup outside the SDK permission controls.

Q: What should be done to remediate the issue?

Update the claude-agent-sdk package to version 0.2.121 or later. If updating cannot happen immediately, do not pass untrusted input directly as the resume session ID and reject dash-leading values.

Published Oct 16, 2026

Updated

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.

Other sources

The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume.

Users are advised to update to the latest version of the claude-agent-sdk package.

Thank you to hackerone.com/moamenmahmood for reporting this issue.

— GitHub

Affected Software

2 affected componentsFixes available

pypi/claude-agent-sdk<0.2.121

pip/claude-agent-sdk<0.2.121

0.2.121

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/claude-agent-sdk to a version that resolves this vulnerability.
Fixed in 0.2.121
Upgrade
Upgrade claude-agent-sdk to a version that resolves this vulnerability.
Fixed in 0.2.121

Event History

Oct 16, 2026

CVE Published

via MITRE·07:44 PM

Data Sourced

via MITRE·07:44 PM

DescriptionWeakness

Advisory Published

via GitHub·07:44 PM

Data Sourced

via GitHub·07:44 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using the Python Claude Agent SDK before version 0.2.121 are exposed only if they pass untrusted input as the session ID supplied to the resume option. Applications that do not allow an attacker to control that value do not meet the stated exploitation condition.

What does an attacker need to provide to exploit the flaw?

The attacker needs control of the resume session ID and must supply a value beginning with a dash so it is parsed as a Claude CLI flag. The described attack injects --mcp-config to configure a stdio MCP server and execute a command when the CLI starts.

Does exploitation bypass SDK permission controls?

Yes. The injected stdio MCP server command executes at Claude CLI startup outside the SDK permission controls.

What should be done to remediate the issue?

Update the claude-agent-sdk package to version 0.2.121 or later. If updating cannot happen immediately, do not pass untrusted input directly as the resume session ID and reject dash-leading values.

CVE-2026-96620: Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to provide to exploit the flaw?

Does exploitation bypass SDK permission controls?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to provide to exploit the flaw?

Does exploitation bypass SDK permission controls?

What should be done to remediate the issue?