Live › vulnerability › CVE-2026-96620
Go to dashboardThe Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, so a value starting with a dash was read as a CLI flag. An attacker who controls the resume session ID can inject an --mcp-config flag that starts an attacker-defined stdio MCP server, running arbitrary commands on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| claude-agent-sdk | pypi | < 0.2.121 | 0.2.121 |
pip show claude-agent-sdk (version below 0.2.121 is affected)
Find code that passes user-supplied input as the resume or session ID argument to ClaudeAgentOptions or query
Upgrade claude-agent-sdk to 0.2.121 or later
Validate or reject session IDs that begin with '-' until upgraded
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume.
Users are advised to update to the latest version of the claude-agent-sdk package.
Thank you to hackerone.com/moamenmahmood for reporting this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-96620")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.