plaincve:~$

// threat brief

CVE-2026-96620

Claude Agent SDK (Python) resume option argument injection: a session ID starting with "-" becomes a CLI flag

CVSS
9.2 CRITICAL
CISA KEV
Not listed
Weakness
CWE-88 · CWE-78 · CWE-20
Topics
AI security

PlainCVE Team · Published 2026-10-20 · AI-assisted · Press brief ↓

AI review 2026-10-20 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Claude Agent SDK for Python versions earlier than 0.2.121 pass the resume value to the Claude CLI unchecked, so a dash-leading value can inject CLI flags.

Who is affectedDevelopers and organizations using claude-agent-sdk (PyPI) earlier than 0.2.121 (< 0.2.121) whose application passes untrusted input as the session ID to the resume option.
What happensAn attacker who controls the resume value can inject arbitrary CLI flags, such as --mcp-config. The vendor's advisory says this can lead to arbitrary command execution at CLI startup that bypasses the SDK's permission controls; the maintainers' fix PR says it is flag injection only, not arbitrary command execution. The two vendor sources disagree.
What to do nowUpgrade claude-agent-sdk to 0.2.121 or later (the vendor advises the latest version). Note: on Windows installs with no bundled claude.exe that launch the CLI through npm's claude.cmd, the maintainers' follow-up PR #1127 says the 0.2.121 fix does not help on the cmd.exe path, and the related fix shipped only in v0.2.124; the sources do not say whether this is within this CVE's scope, and PlainCVE suggests such environments move to at least 0.2.124. Until you upgrade, PlainCVE suggests not passing user-controllable values to resume (the vendor gives no official workaround).
Affected versionsAll versions earlier than 0.2.121 (< 0.2.121, 0.2.121 itself not included)
Fixed versions0.2.121 or later
CVSS vector
Show full vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Timeline
  • First public 2026-07-15

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check the installed version

    Run this in the Python environment (virtual environment) that runs your application; python -m pip makes sure you query that environment's interpreter. It only reads the version and does not change anything. Any version below 0.2.121 is in the affected range.

    Read-only check
    python -m pip show claude-agent-sdk | grep -i '^version'
  2. 02Find where your resume values come from

    The vendor says exploitation requires the application to pass untrusted input to resume. Check whether the resume value can come from users, URL parameters or outside requests. Run it from your own project's source root; it only reads files and does not change anything.

    Read-only check
    grep -rn "resume" --include='*.py' .
    Step 1Step 2
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 0.2.121 or later

    The vendor advises updating to the latest version. After the fix, resume and session-id are passed as a single "--flag=value" argument. This command changes your environment (installs or upgrades a package); run it in the Python environment (virtual environment) that runs your application. -U upgrades to the latest version, which also includes the Windows follow-up fix in v0.2.124.

    Changes your environment
    python -m pip install -U "claude-agent-sdk>=0.2.121"
    Step 3
  2. 02Can't upgrade yet: keep outside input away from resume

    The vendor gives no official workaround. Our analysis: based on the vendor's stated precondition, applications that never pass untrusted input to resume should not be exposed.

    Step 1Step 2
RESPONDRespondIf you find signs of compromise
  1. 01Look for suspicious resume values and MCP servers

    The sources we reviewed contain no detection or response guidance. PlainCVE suggests: if your application ever passed outside input to resume, review logs for session IDs starting with "-", and check whether the CLI started MCP servers or processes you did not configure. No source confirms exploitation in the wild.

    Step 3Step 4
HARDENHardenPrevent the next one
  1. 01Treat session IDs as untrusted data

    PlainCVE suggests: only accept session IDs your own system generated and stored, rather than values supplied by users.

    Step 1Step 2
  2. 02Keep updating, including the extra_args follow-up

    The maintainers' fix PR #1123 (that page contains an attack demonstration, so we do not link it) deliberately left extra_args unchanged. The upstream v0.2.124 release notes say extra_args later also switched to the "--flag=value" form for dash-leading values (PR #1127).

    Step 3
Full remediation steps and notes
PackageAffectedFixed
claude-agent-sdk (PyPI)< 0.2.1210.2.121
TypeScript Agent SDK (per the PR)Not stated0.3.208
  • The vendor advises moving to the latest version, not just 0.2.121. The upstream v0.2.124 release notes show that the same pattern in extra_args was fixed separately later (PR #1127).
  • Windows note: the maintainers’ follow-up PR #1127 (described as a follow-up to the same HackerOne report) says that on Windows installs with no bundled claude.exe that launch the CLI through npm’s claude.cmd, cmd.exe re-parses the arguments, so values such as --resume can execute injected commands, and the 0.2.121 “—flag=value” fix does not help on that path. v0.2.124 refuses to launch a .bat/.cmd CLI on Windows. The sources do not say whether this is within this CVE’s scope; PlainCVE suggests such environments move to at least 0.2.124 and use the native installer or an explicit claude.exe path (the alternatives listed in the PR and release notes).
  • The vendor’s advisory rates it CVSS 4.0 9.2 (critical). PR:N (no privileges required) in the vector is a scoring assumption, not proof that no login is needed in every deployment; AT:P means exploitability depends on how the application is deployed.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Claude Agent SDK (Python) resume option argument injection: a session ID starting with "-" becomes a CLI flag: 1. The attacker supplies a session ID that starts with "-" → 2. The application passes the value to the SDK's resume option → 3. The SDK hands the value to the Claude CLI as a separate argument, and the CLI reads it as a new flag → 4. Per the vendor advisory, the injected --mcp-config can lead to command execution at CLI startup (disputed by the maintainers' PR)CVE-2026-96620 · Claude Agent SDK (Python) resume option argument injection: a session IDstarting with "-" becomes a CLI flagAttackerYour systemThe attacker supplies a session ID that starts with "-" — This is only possible if the application lets outside input decide which session to resume. 1The attackersupplies a sessionID that startswith "-"The application passes the value to the SDK's resume option — The vendor advisory says this is the precondition for exploitation. 2The applicationpasses the valueto the SDK'sresume optionThe SDK hands the value to the Claude CLI as a separate argument, and the CLI reads it as a new flag — Older versions did not check the value, so an attacker could slip in a flag such as --mcp-config. 3The SDK hands thevalue to theClaude CLI as aseparate argument…Per the vendor advisory, the injected --mcp-config can lead to command execution at CLI startup (disputed by the maintainers' PR) — The vendor advisory says this runs arbitrary commands at CLI startup, outside the SDK's permission controls; the maintainers' PR says no shell is involved and it is flag injection only. The two disagree. 4Per the vendoradvisory, theinjected--mcp-config ca…Attack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-96620-claude-agent-sdk-resume-argument-injection · CC BY 4.0
Claude Agent SDK (Python) resume option argument injection: a session ID starting with "-" becomes a CLI flag: 1. The attacker supplies a session ID that starts with "-" → 2. The application passes the value to the SDK's resume option → 3. The SDK hands the value to the Claude CLI as a separate argument, and the CLI reads it as a new flag → 4. Per the vendor advisory, the injected --mcp-config can lead to command execution at CLI startup (disputed by the maintainers' PR)CVE-2026-96620 · Claude Agent SDK(Python) resume option argumentinjection: a session ID starting with"-" becomes a CLI flagThe attacker supplies a session ID that starts with "-" — This is only possible if the application lets outside input decide which session to resume. 1AttackerThe attacker supplies a sessionID that starts with "-"The application passes the value to the SDK's resume option — The vendor advisory says this is the precondition for exploitation. 2Your systemThe application passes thevalue to the SDK's resume optionThe SDK hands the value to the Claude CLI as a separate argument, and the CLI reads it as a new flag — Older versions did not check the value, so an attacker could slip in a flag such as --mcp-config. 3Your systemThe SDK hands the value to theClaude CLI as a separateargument, and the CLI reads itas a new flagPer the vendor advisory, the injected --mcp-config can lead to command execution at CLI startup (disputed by the maintainers' PR) — The vendor advisory says this runs arbitrary commands at CLI startup, outside the SDK's permission controls; the maintainers' PR says no shell is involved and it is flag injection only. The two disagree. 4Your systemPer the vendor advisory, theinjected --mcp-config can leadto command execution at CLIstartup (disputed by themaintainers' PR)Attack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-96620-claude-agent-sdk-resume-argument-injection
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker supplies a session ID that starts with "-"

    This is only possible if the application lets outside input decide which session to resume.

    Defense: Do not pass untrusted input straight into resume (PlainCVE's suggestion).

  2. Your system

    The application passes the value to the SDK's resume option

    The vendor advisory says this is the precondition for exploitation.

  3. Your system

    The SDK hands the value to the Claude CLI as a separate argument, and the CLI reads it as a new flag

    Older versions did not check the value, so an attacker could slip in a flag such as --mcp-config.

    Defense: Upgrade to 0.2.121+: the value is passed joined as --resume=<value>, so it can no longer be read as a separate flag.

  4. Your system

    Per the vendor advisory, the injected --mcp-config can lead to command execution at CLI startup (disputed by the maintainers' PR)

    The vendor advisory says this runs arbitrary commands at CLI startup, outside the SDK's permission controls; the maintainers' PR says no shell is involved and it is flag injection only. The two disagree.

    Defense: Upgrading to 0.2.121+ prevents this flag injection; Windows environments using npm's claude.cmd only got the follow-up fix in v0.2.124 (PR #1127).

Who is affected

ConditionAffected?
claude-agent-sdk (Python) earlier than 0.2.121 (< 0.2.121) + the application passes untrusted input to resumeAffected
Earlier than 0.2.121, but resume values only come from session IDs you generated yourselfOur analysis: based on the vendor’s stated precondition, likely not exposed; upgrading is still recommended
0.2.121 or laterFixed (vendor advisory); but on Windows installs with no bundled claude.exe that launch the CLI through npm’s claude.cmd, the maintainers’ PR #1127 says the 0.2.121 fix does not help on that path, which was fixed only in v0.2.124 — see “How to fix”
TypeScript Agent SDKThe maintainers’ PR says 0.3.208 shipped the same fix; the sources don’t say whether this CVE covers it

OSV records the flaw as present since the first version and does not name a commit that introduced it.

How it works

The Claude Agent SDK doesn’t run the AI itself. It starts the Claude CLI (a command-line tool) in the background and turns your settings into CLI arguments. The resume option continues an earlier session, and its value is a session ID.

Older versions handed this to the CLI as two separate arguments, --resume followed by the ID, without checking what the ID contained. If the ID starts with ”-”, the CLI reads it as another flag (a setting that changes the program’s behaviour) instead of the value of --resume. The vendor advisory’s example is injecting --mcp-config, which it says can lead to command execution at CLI startup.

The two vendor sources disagree on how serious this is:

  • The security advisory: it causes arbitrary command execution at CLI startup and bypasses the SDK’s permission controls.
  • Fix PR #1123 (that page contains an attack demonstration, so we do not link it): arguments are passed one by one with no shell involved, so it is “flag injection,” not arbitrary command execution.

The CVE record lists CWE-88 (argument injection), CWE-78 (OS command injection) and CWE-20 (improper input validation). The maintainers also explain that --session-id already required a value and so wasn’t misread; it was changed too only for consistency.

The flawed approach (conceptual illustration, not the original source code):

Show code example(python)
# The value is a separate argument; if it starts with "-", the CLI treats it as a new flag
args += ["--resume", session_id]

The fixed approach:

Show code example(python)
# Flag and value are joined into one argument, so the value can't be read as its own flag
args += [f"--resume={session_id}"]

Timeline

DateEvent
2026-07-15Maintainers open fix PR #1123 in the public repository (that page contains an attack demonstration, so we do not link it), publicly describing the same issue; this page’s first-disclosure date
2026-07-16PR merged as commit 347a1cb
2026-07-17v0.2.121 released (the release page shows no year; 2026 is inferred from the PR dates)
2026-07-18Maintainers open the Windows follow-up PR #1127
2026-07-20PR #1127 merged and shipped in v0.2.124 (the release page shows no year; 2026 is inferred from the PR dates)
2026-09-12Publication time shown on the advisory in the vendor’s repository (earlier than the CVE reservation, unexplained)
2026-09-23CVE ID reserved
2026-10-16CVE record published; GitHub’s advisory database shows the same date
2026-10-18Still not listed in CISA KEV

Further reading

  • Disclosure date: under our rules, publicly readable content in the project’s own channels describing the same issue counts as a project announcement. The maintainers’ fix PR #1123 (that page contains an attack demonstration, so we do not link it) was opened in the public repository on 2026-07-15, before the vendor advisory’s 2026-09-12 and the CVE record’s 2026-10-16, so this page uses 2026-07-15 as the first-disclosure date. The advisory’s 2026-09-12 date comes before the CVE ID was reserved on 2026-09-23, for unexplained reasons.
  • Exploitation: not in CISA KEV; no source says whether it has been exploited in the wild or before a patch existed. GitHub’s data lists an EPSS (estimated probability of exploitation in the next 30 days) of about 0.58%, roughly the 46th percentile.
  • Credit: the vendor thanks hackerone.com/moamenmahmood for the report.
  • Related weakness types: CWE-88, CWE-78, CWE-20.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-20 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisoryGHSA-h4mw-j7qp-8mwm — Argument Injection via resume Option Allows Arbitrary Command Execution · Anthropic (GitHub) · accessed 2026-10-18
  2. AdvisoryCVE-2026-96620 Record · CVE Program, 2026-10-16 · accessed 2026-10-18
  3. Patch / releaseFix commit 347a1cb · Anthropic (GitHub), 2026-07-16 · accessed 2026-10-18
  4. Patch / releaseclaude-agent-sdk-python v0.2.121 release · Anthropic (GitHub), 2026-07-17 · accessed 2026-10-18
  5. OtherOSV - GHSA-h4mw-j7qp-8mwm · OSV · accessed 2026-10-18
  6. OtherGitHub Advisory Database API - CVE-2026-96620 · GitHub · accessed 2026-10-18
  7. Patch / releaseclaude-agent-sdk-python v0.2.124 release · Anthropic (GitHub) · accessed 2026-10-18
  8. Patch / releaseRefuse to spawn .bat/.cmd CLI scripts on Windows to prevent command injection (PR #1127) · Anthropic (GitHub), 2026-07-20 · accessed 2026-10-18

Press brief

In one sentence

Anthropic's Claude Agent SDK is a toolkit developers use to build AI agents in Python. Versions earlier than 0.2.121 did not check input to the "resume session" option, so an attacker who controls that value can slip in extra command-line settings. The vendor's advisory rates it critical (CVSS 4.0 score 9.2) and says it can lead to arbitrary command execution, while the maintainers' fix notes describe it as flag injection only. The fixed version, 0.2.121, was released on 17 July (year inferred as 2026 from the PR dates).

Key facts

Severity
CVSS 4.0 9.2, critical (vendor advisory) github.com
Fixed version
0.2.121 (released 17 July) github.com
CVE published
2026-10-16 cveawg.mitre.org
GitHub advisory ID
GHSA-h4mw-j7qp-8mwm cveawg.mitre.org
Reported by
hackerone.com/moamenmahmood (credited by the vendor) github.com

Confirmed

  • Versions earlier than 0.2.121 did not check the resume value, so a value starting with "-" is read by the CLI as a separate flag.
  • Exploitation requires the application to pass untrusted input as the session ID to resume.
  • As of 2026-10-18, it is not listed in CISA's Known Exploited Vulnerabilities catalog.

Unconfirmed / disputed

  • Whether it leads to arbitrary command execution: the vendor advisory says yes; the maintainers' fix PR says no shell is involved and it is flag injection only.
  • Disclosure date: this page's first-disclosure date of 2026-07-15 is when the maintainers opened fix PR #1123 in the public repository (the PR publicly describes the same issue); the security advisory in the vendor's repository shows 2026-09-12, before the CVE ID was reserved on 2026-09-23, for unexplained reasons; the CVE record was published on 2026-10-16.
  • The sources do not say whether the Windows injection path through npm's claude.cmd, where cmd.exe re-parses the command line (maintainers' PR #1127, fixed in v0.2.124), is within this CVE's scope.
  • No source says whether it has been exploited in the wild or before a patch existed (zero-day).
  • The sources do not say whether this CVE covers the TypeScript SDK.

Quotable line

A harmless-looking session ID turns from data into an instruction just by starting with a minus sign.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Claude Agent SDK (Python) resume option argument injection: a session ID starting with "-" becomes a CLI flag". PlainCVE. https://plaincve.date/en/vulns/cve-2026-96620-claude-agent-sdk-resume-argument-injection (accessed YYYY-MM-DD)
BibTeX
@misc{cve202696620claudeagentsdkresumeargumentinjection2026,
  title  = {Claude Agent SDK (Python) resume option argument injection: a session ID starting with "-" becomes a CLI flag},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-96620-claude-agent-sdk-resume-argument-injection},
  note   = {Updated 2026-10-20}
}