Claude Agent SDK CVE-2026-96620

Exploitation requires the host application to pass untrusted/attacker-controlled input directly into the SDK's resume option (the session ID to resume); this is the explicit precondition named in the advisory and is NOT the default or recommended usage pattern. The injected value must begin with - (e.g. --mcp-config=...) so the Claude CLI treats it as a standalone flag rather than the option's value, exploiting that --resume is declared with an optional value in the two-token argv form. Limiting factors: applications that resume only internally generated or validated session IDs are not exposed; the flaw affects only claude-agent-sdk versions < 0.2.121 and is fully remediated by the bound --resume=value form in 0.2.121. There is no network-exposed default-configuration path independent of how the embedding application handles session IDs.

No CVSS vector, EPSS score, KEV listing, or SSVC decision data was provided, so several standard prioritization signals are missing and must be stated as such rather than assumed. The vulnerability itself is high-impact - argument injection in the Claude Agent SDK for Python lets an attacker-controlled resume value inject an --mcp-config flag that defines a stdio MCP server, yielding arbitrary command execution at CLI startup and bypassing the SDK's permission controls (CWE-20, Improper Input Validation). However, real-world risk is strongly gated by a non-default precondition: the host application must route untrusted input into the resume/session-ID option, which is not how most applications are built. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this is a serious-but-conditional RCE rather than a confirmed mass-exploitation priority. The fix is confirmed and narrow (switching from the two-token --resume value form to the bound --resume=value form), so remediation is low-cost and should be prioritized for any application that resumes sessions from external input.

An application built on claude-agent-sdk accepts a session ID from an external/untrusted source (e.g. an HTTP parameter or user-supplied job record) and passes it directly to the SDK's resume option. The attacker supplies a crafted value beginning with - such as --mcp-config=... that the Claude CLI parses as a separate flag defining a stdio MCP server, causing the CLI to execute an attacker-specified command at startup with the privileges of the SDK process. No public proof-of-concept was provided in the input data.