CVE-2026-96620
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- EPSS
- 0.58% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- claude-agent-sdk (pip) < 0.2.121, fixed in 0.2.121 · GHSA-h4mw-j7qp-8mwm