HighVulnerabilityLLM-specific
CVE-2026-96620: Claude Agent SDK argument injection via resume option enabling command execution
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-96620
- Published
- Record updated
- Affected
- claude-agent-sdk < 0.2.121
- Fixed in
- 0.2.121
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Claude Agent SDK for Python, prior to 0.2.121, passes the resume option to the Claude CLI as a separate token without validation. A dash-leading value is parsed as an independent CLI flag, so an attacker can inject --mcp-config to define a stdio MCP server and execute arbitrary commands at CLI startup, outside SDK permission controls. Exploitation requires an application that passes untrusted input as the session ID to resume.
Mitigation
Fixed in version 0.2.121.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- claude-agent-sdkPyPILLM dependency since 2025-09-28 · 6 tracked dependents
Topics
Related items
- MediumGHSA-84m7-p3x7-pcfv: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionSame vendor · GitHub Advisory Database
- HighCVE-2026-86063: Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow…Same vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
- HighCVE-2026-101998: Docker Sandboxes fail open when masking credentials in proxy responsesSame vendor · NVD/CVE Database
- HighCVE-2026-103435: Claude Code symlink race condition allows writes outside project directorySame vendor · NVD/CVE Database