AnthropicGHSA-h4mw-j7qp-8mwm
Argument Injection via resume Option Allows Arbitrary Command Execution
Critical9.2CVE-2026-96620 · Published Sep 12, 2026 · updated Sep 23, 2026
The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginning with `-` to be interpreted as a separate CLI flag. An attacker who controlled the `resume` value could inject an `--mcp-config` flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume. Users are advised to update to the latest version of the claude-agent-sdk package. Thank you to hackerone.com/moamenmahmood for reporting this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| claude-agent-sdk PyPI | < 0.2.121 | 0.2.121 |
Details and references
More Anthropic advisories
All Anthropic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 25 | Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host | High8.5 | 1.15962.0 |
| Jul 1 | Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation | Medium6.3 | 0.8.0+1 more |
| Jul 1 | Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref | Medium5.9 | 0.7.0 |
| Jun 25 | Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write | Medium4.4 | 2.1.128 |
| Jun 25 | Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution | High7.7 | 2.1.163 |
| Jun 13 | Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch | Medium6.0 | 2.1.163 |