CVE-2026-96620 in Claude Agent SDK
Summary
by MITRE • 10/16/2026
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within Claude Agent SDK versions prior to 0.2.121 represents a critical command injection flaw arising from improper validation of user-supplied input during session resumption operations. The core technical issue stems from the manner in which the resume option is transmitted to the underlying Claude Command Line Interface. Specifically, when an application passes untrusted input as the session identifier for the purpose of resuming a previous interaction, this value is passed directly to the CLI without adequate sanitization or validation checks. Because the value is treated as a separate token rather than being strictly bound to its intended parameter context, it becomes susceptible to argument injection attacks where malicious actors can manipulate how subsequent arguments are parsed by the shell environment.
This architectural flaw allows an attacker who controls the session ID input to inject arbitrary command-line flags into the execution stream. By crafting a payload that begins with a dash character, such as --mcp-config, the injected string is interpreted not as data but as a distinct CLI flag. This misinterpretation enables the specification of external configurations, particularly those defining standard I/O Model Context Protocol servers. The exploitation of this vector results in arbitrary command execution at the moment the CLI initializes. Crucially, this execution occurs outside the scope of the SDK’s built-in permission controls and sandboxing mechanisms, effectively bypassing security boundaries designed to restrict the actions an agent can perform.
The operational impact of this vulnerability is severe, as it grants attackers the ability to execute arbitrary commands with the privileges of the user running the Claude CLI process. This can lead to full system compromise, data exfiltration, or lateral movement within a network environment depending on the context in which the SDK is deployed and the permissions associated with the executing account. The risk is particularly acute in environments where session identifiers are derived from external sources or user inputs that have not been rigorously validated against injection patterns.
To mitigate this vulnerability, organizations must immediately upgrade to Claude Agent SDK version 0.2.121 or later, which implements proper validation and escaping mechanisms for the resume option input. In addition to upgrading, developers should enforce strict allow-listing of session ID characters and avoid passing untrusted data directly into CLI arguments without intermediate sanitization layers that strip or escape leading dash characters. This issue is categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. From a tactical perspective, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically highlighting the risk associated with argument injection within automated agent workflows.