CVE-2026-96620criticalCode execution2026-10-16
CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
Before 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands.
What it is
GitHub advisory: the SDK “passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag.”
An attacker who controls that value can inject --mcp-config defining a stdio MCP server, which runs arbitrary commands at CLI startup and bypasses the SDK’s permission controls.
It is only exploitable when your app passes untrusted input (for example a session ID from a request) as the resume value.
How to check
- Affected: claude-agent-sdk (pip) below 0.2.121.
- Search your code for resume= and check whether the value can come from a user, URL or request body.
How to fix
- Upgrade claude-agent-sdk to 0.2.121 or later.
- Never pass user-supplied session IDs to the SDK without validating them against IDs your app created.
pip show claude-agent-sdk | grep Version
pip install -U "claude-agent-sdk>=0.2.121"Sources
More advisories for this tool
- highCVE-2026-86063: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
- highCVE-2026-55607: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
- highCVE-2026-40068: Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
- highCVE-2026-39861: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace