claude-agent-sdk Fixes Critical-Severity Bug CVE-2026-96620
A critical-severity advisory for the pip package claude-agent-sdk is fixed in version 0.2.121.
Key points
- claude-agent-sdk (pip) has a critical flaw.
- Tracked as CVE-2026-96620.
- Version 0.2.121.
Maintainers of claude-agent-sdk, a package in the pip ecosystem, have published a critical-severity security advisory (CVE-2026-96620): Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution.
At a glance
- Advisory
- GHSA-h4mw-j7qp-8mwm
- CVE
- CVE-2026-96620
- Package
- claude-agent-sdk (pip)
- Severity
- Critical
- Patched in
- 0.2.121
What is the issue?
The GitHub-reviewed advisory explains: The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume. Users are advised to update to the latest version of the claude-agent-sdk package. Thank you to hackerone.com/moamenmahmood for reporting this issue.
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| pip | claude-agent-sdk | < 0.2.121 | 0.2.121 |
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: CVE-2026-96620
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96620?
CVE-2026-96620 is a security vulnerability in claude-agent-sdk (pip).
Which version fixes CVE-2026-96620?
The fix is in version 0.2.121.
