Claude Agent SDK Argument Injection via resume Option

The Claude Agent SDK for Python contains a critical argument injection vulnerability (CVE-2026-96620) caused by improper validation of the resume option. When an application utilizes this SDK and passes untrusted user input as a session ID to the resume functionality, the underlying Claude CLI incorrectly parses the input. An attacker can supply a value beginning with a dash (-), which the CLI interprets as an additional command-line flag rather than a data string. By injecting the --mcp-config flag, an attacker can specify a malicious stdio-based Model Context Protocol (MCP) server configuration, leading to arbitrary code execution when the CLI initializes. This vulnerability effectively bypasses intended SDK permission controls, allowing execution in the context of the user running the agent.

Impact

Successful exploitation allows for arbitrary command execution on systems running applications that integrate vulnerable versions of the Claude Agent SDK (< 0.2.121). This impacts any software or automation pipeline utilizing the SDK to manage sessions with user-supplied input, potentially leading to unauthorized access to host environments, sensitive data exfiltration, or persistence.

Recommendation

• Update the claude-agent-sdk Python package to version 0.2.121 or later immediately.
• Audit applications using claude-agent-sdk to ensure that session ID or resume parameter inputs are strictly sanitized and validated against an allowlist before being passed to the SDK.
• Review process execution logs for applications utilizing the SDK to identify unexpected command-line arguments being passed to the claude CLI binary.