Claude Agent SDK for Python: Argument Injection via `resume` Enables Arbitrary Command Execution (CVE-2026-96620)

What Happened

A GitHub Security Advisory (GHSA-h4mw-j7qp-8mwm) discloses that the Claude Agent SDK for Python passed the resume option through to the Claude CLI without validation. A value beginning with a hyphen (-) could be interpreted as a separate CLI flag rather than a session identifier. According to the advisory, an attacker able to control the resume value could inject an --mcp-config flag defining a malicious stdio MCP server, leading to arbitrary command execution at CLI startup — and bypassing the SDK's own permission controls in the process. Exploitation requires an application to pass untrusted input directly as the session ID to resume. The issue is tracked as CVE-2026-96620, exploit status is listed as PoC-public, and credit for the report goes to HackerOne researcher moamenmahmood.

Why It Matters

This affects any application built on the claude-agent-sdk Python package that exposes the resume parameter to user-controllable input — for example, a web service or chat interface that lets a client specify or replay a session ID. Because the injected flag is processed at CLI startup, the resulting command execution happens before the SDK's permission model has a chance to intervene, which is a more severe outcome than a typical sandboxed-tool-call issue. Any team embedding this SDK in an agent-facing product should treat this as a direct code-execution risk, not just an input-validation nuisance.

What Defenders Should Watch For / Do Now

• Update claude-agent-sdk to the latest patched version as advised in the GHSA — this is the primary remediation.
• Audit any code path where a resume/session-ID value originates from end users, URL parameters, stored state, or other untrusted sources, and treat it as attacker-controlled until the SDK is patched.
• As a hunting angle, review process-creation and command-line logs on hosts running agent SDK workloads for CLI invocations containing unexpected --mcp-config flags or MCP server definitions that weren't part of the application's intended configuration.
• Consider allow-listing or strictly validating session-ID formats (e.g., rejecting values starting with -) at the application layer as a defense-in-depth measure independent of the SDK fix.

Developing Intel

This is a same-day disclosure and details may evolve as more information becomes available. For the authoritative advisory, patched version details, and reporter credit, see the original GitHub Security Advisory: GHSA-h4mw-j7qp-8mwm.