{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-96620",
    "name": "CVE-2026-96620",
    "vendor": "claude-agent-sdk",
    "description": "Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical, and NVD published it as CVE-2026-96620 on 16 October with GitHub as CNA and a CVSS 4.0 score of 9.2. Before 0.2.121 the SDK passed its resume option to the Claude Code CLI as a separate argument without validating it, so a session ID that began with a dash was read as a flag of its own. An attacker who controls that value can inject --mcp-config to define a stdio MCP server, and the CLI runs that server's command at startup, outside the SDK's permission controls. It can only be exploited where an application passes untrusted input, such as a session ID taken from a request or a URL, as the resume value. The fix is in 0.2.121 (PR 1123). No exploitation has been reported. Scanners keyed on the CVE will only have flagged it since October, about a month after the advisory.",
    "website": "https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "claude-agent-sdk",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-16",
    "risk": {
      "score": 92,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-96620",
      "aliases": [
        "ti-137",
        "GHSA-h4mw-j7qp-8mwm"
      ],
      "title": "CVE-2026-96620: A Dash-Leading Resume ID in the Claude Agent SDK for Python Became a CLI Flag That Defined a Command-Running MCP Server (CVSS 9.2)",
      "summary": "Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical, and NVD published it as CVE-2026-96620 on 16 October with GitHub as CNA and a CVSS 4.0 score of 9.2. Before 0.2.121 the SDK passed its resume option to the Claude Code CLI as a separate argument without validating it, so a session ID that began with a dash was read as a flag of its own. An attacker who controls that value can inject --mcp-config to define a stdio MCP server, and the CLI runs that server's command at startup, outside the SDK's permission controls. It can only be exploited where an application passes untrusted input, such as a session ID taken from a request or a URL, as the resume value. The fix is in 0.2.121 (PR 1123). No exploitation has been reported. Scanners keyed on the CVE will only have flagged it since October, about a month after the advisory.",
      "severity": "critical",
      "cvss": {
        "score": 9.2,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "claude-agent-sdk",
        "vendor": null,
        "package": "claude-agent-sdk",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<0.2.121",
          "fixed": "0.2.121"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-16",
      "modifiedAt": "2026-10-16",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96620"
        }
      ],
      "mitigation": "Upgrade claude-agent-sdk to 0.2.121 or later (0.2.168 was current on 19 October 2026). In applications built on the SDK, never pass user-supplied values straight to resume: accept only session IDs your application issued, check them against the expected format and reject anything that starts with a dash, and look the real ID up server-side. On hosts that run SDK-based services, review for unexpected --mcp-config arguments, MCP server definitions or child processes started by the Claude CLI.",
      "detectedByAnomity": true
    }
  }
}