PT-2026-116154 · Anthropic · Claude Agent Sdk
CVE-2026-96620
·
Published
2026-10-16
·
Updated
2026-10-16
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Claude Agent SDK versions prior to 0.2.121
Description
An issue exists where the
resume option is passed to the Claude CLI as a separate token without validation. This allows a value starting with a dash to be parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, leading to arbitrary command execution at CLI startup that bypasses SDK permission controls. This occurs when an application passes untrusted input as the session ID to resume.Recommendations
Update to version 0.2.121.
Fix
Argument Injection
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Claude Agent Sdk