Claude Agent SDK Flag Injection in Resume Inputs Enables Arbitrary Command Execution Prior to 0.2.121

The Claude Agent SDK for Python contains a critical command injection flaw that permits arbitrary code execution when applications handle untrusted session identifiers. This vulnerability arises because the software fails to validate inputs passed to the underlying command-line interface, allowing attackers to manipulate system behaviour.

Root cause

The vulnerability stems from how the SDK handles the resume option. According to the GitHub advisory, the software passes this value directly to the Claude CLI without checking its content. If the input begins with a dash, the command-line interface interprets it as a separate flag rather than a session identifier. This lack of sanitisation allows an attacker to append their own command-line arguments.

The National Vulnerability Database classifies the issue under CWE-20 and CWE-78. The flaw enables an attacker to inject the --mcp-config flag. This specific flag allows the definition of a stdio MCP server. Once defined, this server executes arbitrary commands at startup, bypassing the SDK's built-in permission controls.

Attack path

Exploitation requires an application to pass untrusted input as the session ID to resume. An attacker who controls this value can craft a string that starts with a dash. This string is parsed as an independent CLI flag. The injected --mcp-config flag then triggers the creation of a malicious server. This results in command execution outside the intended security boundaries.

Affected versions

• anthropics claude-agent-sdk-python versions earlier than 0.2.121 are vulnerable.
• Version 0.2.121 includes the fix for this issue.
• The flaw affects the pip package claude-agent-sdk.

Mitigation

• Update the claude-agent-sdk package to version 0.2.121 or later.
• Review applications that pass external inputs to the resume option.
• Ensure session IDs are validated before being processed by the SDK.
• Monitor command-line arguments for unexpected flag injections.

Why it matters

Teams usually assume that SDKs enforce strict boundaries between application logic and system commands. When input validation is missing at the integration layer, attackers can bypass these controls. Check whether your applications expose session identifiers to user control. Verify that all command-line arguments are sanitised before execution. Ensure that permission models are not undermined by external inputs.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: Claude Agent SDK

• Upgrade the Python package to the patched version immediately.
• Audit code that passes user-controlled data to CLI tools.
• Implement strict input validation for session identifiers.
• Monitor logs for unexpected command-line flag usage.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96620?

The CVSS score is 9.2, which is rated as critical.

Who reported this vulnerability?

The issue was reported by hackerone.com/moamenmahmood.

Does this affect all Python SDKs?

No, it specifically affects the Claude Agent SDK for Python before version 0.2.121.