Claude Agent SDK Python CLI Injection Bypasses Permission Controls

The Claude Agent SDK for Python contains a critical command injection vulnerability that allows attackers to execute arbitrary code on the host system. This flaw, tracked as CVE-2026-96620, stems from how the software handles session resumption parameters. When applications pass untrusted input as the session identifier to resume a previous interaction, the SDK fails to sanitize the data before forwarding it to the underlying command-line interface. This exposure affects environments where user-controlled or external data influences the resume parameter, allowing an attacker to bypass the SDK’s intended permission controls entirely.

Root cause

The vulnerability arises from insufficient input validation in the SDK’s handling of the resume option. Prior to version 0.2.121, the software passed this option to the Claude CLI as a separate token without checking its format. If the value begins with a dash, the command-line parser interprets it as an independent flag rather than a session identifier. This behavior violates secure parsing principles, as it allows an attacker to inject additional arguments into the command execution chain. The specific weakness involves the lack of sanitization for special characters that define command-line options.

Attack path

An attacker exploits this issue by controlling the value passed to the resume option. By crafting a session ID that starts with a dash, the attacker can inject the --mcp-config flag. This flag allows the definition of a stdio Model Context Protocol server. When the CLI starts up, it processes this injected configuration, leading to arbitrary command execution. This execution occurs outside the SDK’s permission controls, meaning the injected commands run with the same privileges as the CLI process itself. The attack requires the application to accept untrusted input for the session ID field.

Affected versions

The vulnerability impacts the claude-agent-sdk-python package distributed via pip. All versions prior to 0.2.121 are considered vulnerable to this command injection flaw. The issue is specific to the Python implementation of the SDK. Users running older versions of the package are exposed to the risk if their applications pass external or untrusted data into the resume parameter. The fix was introduced in version 0.2.121, which adds necessary validation to the resume option handling.

Mitigation

• Upgrade the claude-agent-sdk-python package to version 0.2.121 or later.
• Audit applications to ensure the resume option only accepts trusted, internally generated session identifiers.
• Implement input validation to reject values starting with dashes or other special characters.
• Monitor CLI startup logs for unexpected flag injection or MCP server configurations.

Signals worth monitoring

Teams usually detect this type of activity by reviewing command-line execution logs for unexpected flags. Look for instances where the resume parameter contains values that resemble command options. Check for the appearance of the --mcp-config flag in process arguments, as this indicates an attempt to define external servers. Monitor for the launch of stdio processes that were not initiated by the application’s normal workflow. Verify that session identifiers conform to expected formats, rejecting any input that begins with special characters. Alert on processes that spawn child processes with elevated privileges or unexpected network connections.

Background: Command injection

Command injection occurs when an application passes untrusted input directly to a system shell. This allows attackers to execute arbitrary commands on the server. You prevent it by avoiding shell execution entirely or by strictly validating and escaping all user-supplied input before processing.

Read the full guide: Command Injection: How It Works and How to Stop It

What to do and how to stay safe: Claude Agent SDK

• Verify the installed version of the claude-agent-sdk-python package and update to 0.2.121 if necessary.
• Review application code to ensure the resume parameter is not populated with user-supplied or external data.
• Implement strict input validation to reject any resume values that start with a dash or other CLI special characters.
• Monitor system logs for unexpected command-line flags or the initialization of MCP servers during CLI startup.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which version of the SDK fixes this vulnerability?

Version 0.2.121 of the claude-agent-sdk-python package includes the fix for CVE-2026-96620.

How does the attack bypass permission controls?

The injected --mcp-config flag causes arbitrary command execution at CLI startup, outside the SDK’s permission controls.

What is required for exploitation?

An application must pass untrusted input as the session ID to the resume option for the attack to succeed.