anthropics claude-agent-sdk-python vulnerabilities (CVE)

CVE records published for anthropics claude-agent-sdk-python, newest first. Follow to get an email when a new one appears.

1 results

9.2Critical

CVE-2026-96620 25 days ago

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

anthropics claude-agent-sdk-python

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config fla…