{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/claude-agent-sdk--0.2.121/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:anthropic:claude-agent-sdk:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-96620"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["claude-agent-sdk (\u003c 0.2.121)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Anthropic"],"content_html":"\u003cp\u003eThe Claude Agent SDK for Python contains a critical argument injection vulnerability (CVE-2026-96620) caused by improper validation of the \u003ccode\u003eresume\u003c/code\u003e option. When an application utilizes this SDK and passes untrusted user input as a session ID to the resume functionality, the underlying Claude CLI incorrectly parses the input. An attacker can supply a value beginning with a dash (\u003ccode\u003e-\u003c/code\u003e), which the CLI interprets as an additional command-line flag rather than a data string. By injecting the \u003ccode\u003e--mcp-config\u003c/code\u003e flag, an attacker can specify a malicious stdio-based Model Context Protocol (MCP) server configuration, leading to arbitrary code execution when the CLI initializes. This vulnerability effectively bypasses intended SDK permission controls, allowing execution in the context of the user running the agent.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution on systems running applications that integrate vulnerable versions of the Claude Agent SDK (\u0026lt; 0.2.121). This impacts any software or automation pipeline utilizing the SDK to manage sessions with user-supplied input, potentially leading to unauthorized access to host environments, sensitive data exfiltration, or persistence.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003eclaude-agent-sdk\u003c/code\u003e Python package to version 0.2.121 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003eclaude-agent-sdk\u003c/code\u003e to ensure that session ID or \u003ccode\u003eresume\u003c/code\u003e parameter inputs are strictly sanitized and validated against an allowlist before being passed to the SDK.\u003c/li\u003e\n\u003cli\u003eReview process execution logs for applications utilizing the SDK to identify unexpected command-line arguments being passed to the \u003ccode\u003eclaude\u003c/code\u003e CLI binary.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T22:28:22Z","date_published":"2026-10-16T22:28:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-claude-agent-sdk-argument-injection/","summary":"The Claude Agent SDK for Python fails to validate the resume option, enabling an argument injection attack that allows arbitrary command execution via unauthorized MCP server configurations.","title":"Claude Agent SDK Argument Injection via resume Option","url":"https://feed.craftedsignal.io/briefs/2026-10-claude-agent-sdk-argument-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Claude-Agent-Sdk (\u003c 0.2.121)","version":"https://jsonfeed.org/version/1.1"}