Claude Agent SDK Flaw (CVSS 9.2) Let a Resume Value Inject CLI Flags

The National Vulnerability Database published its entry for CVE-2026-96620 on October 16, 2026, giving wider visibility to a critical flaw in how the Python Claude Agent SDK — the library Anthropic distributes for building agents on top of Claude — handled its resume option. The flaw was first disclosed in a GitHub security advisory, GHSA-h4mw-j7qp-8mwm, published September 12, 2026 and updated the same day the NVD entry went live. Both trackers cover every release of the SDK before version 0.2.121 and list the same CVSS v4.0 base score, 9.2, rated critical.

How the resume option could be turned into an attack

The Claude Agent SDK lets a calling application resume a prior agent session by passing a session identifier through a resume parameter. According to the GitHub advisory, the SDK forwarded that value to the underlying Claude CLI as a separate command-line token without checking its contents first. Because command-line parsers treat any token starting with a dash as a new flag rather than as data, a resume value crafted to begin with a dash was read by the CLI as an independent argument instead of a session ID.

The advisory explains that this allowed an attacker who controlled the resume value to smuggle in an --mcp-config flag defining a new, attacker-chosen stdio MCP server. Because that flag is processed when the CLI starts up, the injected server configuration could execute arbitrary commands before the SDK's own permission controls — the layer meant to gate what an agent is allowed to do — had a chance to apply. The GitLab Advisory Database's independent writeup of the same CVE confirms this mechanism and the same affected version range, before 0.2.121.

Who was exposed

Exploitation had a specific precondition: an application built on the SDK had to pass untrusted, externally supplied input directly into the resume parameter — for example, a session ID taken from a URL, an API request body, or another user-controlled channel. Software that only ever resumed sessions using identifiers it generated and stored itself was not exposed through this path. The advisory credits the finding to a researcher known as moamenmahmood, via a report submitted through HackerOne.

Because the Claude Agent SDK underlies a growing number of third-party agent products and internal tools, the practical risk fell on whichever of those products exposed a resume-style "continue this conversation" feature to end users without first validating the identifier format. For such an application, the attack required no authentication and no user interaction beyond submitting the crafted value, which is part of why GitHub and NVD both rated it critical.

What changed in the fix

Version 0.2.121 of the SDK addresses the flaw by changing how the resume and related session_id options are passed to the CLI: instead of being sent as a value that could be split into a separate argv token, they are now joined to their flag name with an equals sign in a single token, so a dash-prefixed value can no longer be parsed as an independent flag. Anthropic's release notes for that version, published on the project's GitHub repository, describe the change as part of a broader pass of CLI-argument hardening that also closed a related command-injection path in the SDK's build scripts.

Why this matters beyond one SDK

Argument injection of this kind is not unique to Claude's tooling. Any library that wraps a command-line program and forwards caller-supplied strings into that program's argv list is exposed to the same class of bug once a value can begin with a dash. For developers and researchers building agent frameworks, the specific lesson from this advisory is to treat every value that crosses a process boundary — not just values that look like code — as a potential flag, and to either reject dash-prefixed input outright or join it to its parameter name before handing it to a subprocess call. The second lesson is architectural: the advisory notes that the injected configuration executed before the SDK's permission system engaged, which is a reminder that a permission layer only protects what happens after it runs, not what happens during process startup.

Teams running agent applications built on the Python Claude Agent SDK can check their installed version with pip show claude-agent-sdk and should upgrade to 0.2.121 or later if they accept session identifiers from outside their own system. No independent exploitation data accompanies the advisory, and GitHub and NVD both record the flaw as fixed with no evidence cited of in-the-wild use before disclosure.