Tracking: CVE-2026-96620
Severity: Critical
Who is affected
The Python package claude-agent-sdk before 0.2.121, when an application passes attacker-controlled input as the resume session identifier.
How the attack works
A value beginning with a dash can be parsed as a new command-line option rather than a session ID. The report uses this behavior to inject MCP configuration, which starts a stdio command during CLI startup.
Execution occurs with the SDK process's privileges before the normal permission controls protect the operation. A strict tool permission policy does not compensate for this earlier argument-parsing failure.
What to do
- Upgrade to 0.2.121 or later and restart applications using the SDK.
- Trace how resume IDs enter the application. Accept only valid identifiers associated with sessions that the caller is authorized to resume.
- Review unexpected CLI options, MCP configurations, and startup child processes. Assess accessible files and credentials if untrusted resume values reached a vulnerable deployment.
Scope and limits
An application that never accepts untrusted resume values has a different exposure profile. The flaw is not established merely by using the SDK for ordinary prompts.