Key points
- CVE-2026-96620 allows attackers to execute commands by injecting CLI flags through the resume option.
- The vulnerability affects Python versions prior to 0.2.121 and is rated Critical with a CVSS score of 9.2.
- A patch is available in version 0.2.121, fixing the lack of input validation on session IDs.
An attacker who controls session input can execute arbitrary commands on systems running the Claude Agent SDK for Python. This flaw bypasses the software's built-in permission controls, granting full control at the moment the command-line interface starts. The risk exists because the application passes untrusted data directly to the underlying tool without checking for malicious flags.
In plain English
The Claude Agent SDK is a Python toolkit that helps developers build applications using Claude Code. It includes a feature called 'resume' that allows users to continue a previous session. The problem arises when this feature accepts a session identifier that looks like a command-line instruction. Instead of treating the input as a simple label, the system interprets it as a new command, allowing an attacker to insert their own instructions.
The background
This issue, tracked as CVE-2026-96620, has a CVSS severity rating of 9.2, which is classified as Critical. It stems from weaknesses in input handling, specifically CWE-20, CWE-78, and CWE-88. The flaw allows a dash-leading value to be parsed as an independent flag. This enables the injection of the '--mcp-config' flag, which defines a server that runs commands outside the SDK's safety boundaries.
What changes now
Developers using the claude-agent-sdk package should update to version 0.2.121 immediately. This release includes the necessary validation to prevent the resume option from being interpreted as a command-line argument. The fix ensures that session IDs are treated strictly as identifiers, blocking the injection of malicious flags that could lead to system compromise.
The attacker's path
Teams should assess how applications handle external inputs passed to command-line tools. This vulnerability demonstrates the risk of passing user-controlled data directly to system commands without sanitisation. Review your integration points to ensure that session identifiers or similar parameters are validated before use. Look for any instances where internal tools might interpret user input as executable flags, which could allow privilege escalation or command injection.
What to do and how to stay safe: Claude Agent SDK
- Update the claude-agent-sdk package to version 0.2.121 or later to apply the official fix.
- Audit applications to ensure they do not pass untrusted user input directly to the resume option.
- Implement strict input validation for any parameters that are forwarded to command-line interfaces.
- Monitor system logs for unexpected command executions or unusual flag usage during CLI startup.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Claude Agent SDK are affected by this vulnerability?
All Python versions prior to 0.2.121 are vulnerable to CVE-2026-96620.
What allows an attacker to exploit this flaw?
An attacker needs control over the session ID passed to the resume option, which is then injected as a CLI flag.
Is there a fix available for CVE-2026-96620?
Yes, the issue is fixed in version 0.2.121 of the claude-agent-sdk package.
