All vulnerabilities
CVE-2026-96620GHSA-h4mw-j7qp-8mwm

claude-agent-sdk: Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

anthropics claude-agent-sdkpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.58%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.2.121Fixed versionGitHub
Published16 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.2.121claude-agent-sdk, pipGitHub
  • 0.2.121claude-agent-sdk, PyPIOSVpip install "claude-agent-sdk>=0.2.121"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume.

Users are advised to update to the latest version of the claude-agent-sdk package.

Thank you to hackerone.com/moamenmahmood for reporting this issue.

Text from GitHub Advisory Database

Affected versions 53

  • claude-agent-sdk, pip< 0.2.121GitHub
  • claude-agent-sdk-pythonaffected: < 0.2.121CVE List
  • claude-agent-sdk, PyPIfrom first release, fixed in 0.2.121OSV
  • claude-agent-sdk, PyPI0.0.23OSV
  • claude-agent-sdk, PyPI0.1.0OSV
  • claude-agent-sdk, PyPI0.1.1OSV
  • claude-agent-sdk, PyPI0.1.10OSV
  • claude-agent-sdk, PyPI0.1.18OSV
  • claude-agent-sdk, PyPI0.1.19OSV
  • claude-agent-sdk, PyPI0.1.2OSV
  • claude-agent-sdk, PyPI0.1.20OSV
  • claude-agent-sdk, PyPI0.1.21OSV
  • claude-agent-sdk, PyPI0.1.22OSV
  • claude-agent-sdk, PyPI0.1.23OSV
  • claude-agent-sdk, PyPI0.1.25OSV
  • claude-agent-sdk, PyPI0.1.26OSV
  • claude-agent-sdk, PyPI0.1.27OSV
  • claude-agent-sdk, PyPI0.1.29OSV
  • claude-agent-sdk, PyPI0.1.3OSV
  • claude-agent-sdk, PyPI0.1.30OSV
  • claude-agent-sdk, PyPI0.1.31OSV
  • claude-agent-sdk, PyPI0.1.33OSV
  • claude-agent-sdk, PyPI0.1.34OSV
  • claude-agent-sdk, PyPI0.1.35OSV
  • claude-agent-sdk, PyPI0.1.36OSV
  • claude-agent-sdk, PyPI0.1.37OSV
  • claude-agent-sdk, PyPI0.1.38OSV
  • claude-agent-sdk, PyPI0.1.39OSV
  • claude-agent-sdk, PyPI0.1.4OSV
  • claude-agent-sdk, PyPI0.1.41OSV
  • claude-agent-sdk, PyPI0.1.43OSV
  • claude-agent-sdk, PyPI0.1.44OSV
  • claude-agent-sdk, PyPI0.1.45OSV
  • claude-agent-sdk, PyPI0.1.46OSV
  • claude-agent-sdk, PyPI0.1.47OSV
  • claude-agent-sdk, PyPI0.1.48OSV
  • claude-agent-sdk, PyPI0.1.49OSV
  • claude-agent-sdk, PyPI0.1.5OSV
  • claude-agent-sdk, PyPI0.1.50OSV
  • claude-agent-sdk, PyPI0.1.51OSV
  • claude-agent-sdk, PyPI0.1.52OSV
  • claude-agent-sdk, PyPI0.1.53OSV
  • claude-agent-sdk, PyPI0.1.54OSV
  • claude-agent-sdk, PyPI0.1.55OSV
  • claude-agent-sdk, PyPI0.1.56OSV
  • claude-agent-sdk, PyPI0.1.58OSV
  • claude-agent-sdk, PyPI0.1.59OSV
  • claude-agent-sdk, PyPI0.1.6OSV
  • claude-agent-sdk, PyPI0.1.60OSV
  • claude-agent-sdk, PyPI0.1.61OSV
  • claude-agent-sdk, PyPI0.1.62OSV
  • claude-agent-sdk, PyPI0.1.63OSV
  • claude-agent-sdk, PyPI0.1.64OSV

References 5