GHSA-h4mw-j7qp-8mwm: Input Validation
The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume.
Users are advised to update to the latest version of the claude-agent-sdk package.
Thank you to hackerone.com/moamenmahmood for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/claude-agent-sdkto a version that resolves this vulnerability.Fixed in 0.2.121
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed only if they pass untrusted input as the session ID through the SDK's resume option. The attacker must be able to control that resume value.
What does an attacker need to provide to exploit it?
The attacker needs to supply a resume value beginning with a hyphen so it is interpreted as a Claude CLI option rather than a session ID. This can inject an --mcp-config option that defines a stdio MCP server and executes a command when the CLI starts.
What is the impact of successful exploitation?
Successful exploitation can result in arbitrary command execution at Claude CLI startup. The injected execution bypasses the SDK's permission controls.
What should teams do if they use the affected package?
Update the claude-agent-sdk package to the latest version. Until updating, do not pass untrusted or externally controllable values as session IDs to the resume option.