GHSA-h4mw-j7qp-8mwm

Suggest an improvement
Source
https://github.com/advisories/GHSA-h4mw-j7qp-8mwm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h4mw-j7qp-8mwm/GHSA-h4mw-j7qp-8mwm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h4mw-j7qp-8mwm
Aliases
  • CVE-2026-96620
Published
2026-10-16T19:44:37Z
Modified
2026-10-16T20:00:04Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Details

The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume.

Users are advised to update to the latest version of the claude-agent-sdk package.

Thank you to hackerone.com/moamenmahmood for reporting this issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-20",
        "CWE-78",
        "CWE-88"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-16T19:44:37Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / claude-agent-sdk

Package

Name
claude-agent-sdk
View open source insights on deps.dev
Purl
pkg:pypi/claude-agent-sdk

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.2.121

Affected versions

0.*
0.0.23
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.18
0.1.19
0.1.20
0.1.21
0.1.22
0.1.23
0.1.25
0.1.26
0.1.27
0.1.29
0.1.30
0.1.31
0.1.33
0.1.34
0.1.35
0.1.36
0.1.37
0.1.38
0.1.39
0.1.41
0.1.43
0.1.44
0.1.45
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.51
0.1.52
0.1.53
0.1.54
0.1.55
0.1.56
0.1.58
0.1.59
0.1.60
0.1.61
0.1.62
0.1.63
0.1.64
0.1.65
0.1.66
0.1.68
0.1.69
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78
0.1.80
0.1.81
0.2.82
0.2.83
0.2.84
0.2.85
0.2.86
0.2.87
0.2.88
0.2.89
0.2.90
0.2.91
0.2.93
0.2.94
0.2.95
0.2.96
0.2.97
0.2.99
0.2.100
0.2.101
0.2.102
0.2.103
0.2.104
0.2.105
0.2.106
0.2.107
0.2.108
0.2.109
0.2.110
0.2.111
0.2.112
0.2.113
0.2.114
0.2.115
0.2.116
0.2.117
0.2.118
0.2.119
0.2.120

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h4mw-j7qp-8mwm/GHSA-h4mw-j7qp-8mwm.json"