CVE-2026-96620

9.2Critical

Published 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.2Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-20, CWE-78, CWE-88

Impact

Remote attackers can execute arbitrary commands outside SDK permission controls. They need the target application to accept and pass attacker-controlled input as a session ID to the resume option.

Root cause

The SDK passes the resume parameter to the Claude CLI as an unvalidated token, letting leading dashes inject new CLI flags like --mcp-config.

Affected systems

Claude Agent SDK for Python prior to 0.2.121

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade claude-agent-sdk to version 0.2.121 or higher. If patching immediately is not possible, sanitize or reject resume session ID inputs starting with a dash ('-').

shell

$ pip install --upgrade 'claude-agent-sdk>=0.2.121'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-96620