Claude Agent SDK for Python: Argument injection via resume option

Summary

The Claude Agent SDK for Python passes the resume and session_id options to the Claude CLI as separate argument tokens without validation. A dash-leading value is parsed as an independent CLI flag, so an attacker can inject flags such as --mcp-config and make the CLI start a stdio MCP server that runs arbitrary commands outside the SDK permission controls. Exploitation requires an application that passes untrusted input as the session ID to resume.

Affected

• anthropics claude-agent-sdk-python (Python package claude-agent-sdk) before 0.2.121

Fixed in

• Version 0.2.121 (the vendor passes resume and session_id as --flag=value)

Workaround

• Unknown.
• Until the update is applied, reject user-supplied session IDs that start with a dash.

Exploitation

• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• No public proof of concept or evidence of in-the-wild exploitation found at the time of writing.

Our recommendation

• Identify all projects that use claude-agent-sdk and check for versions below 0.2.121.
• Update to 0.2.121 or later.
• Audit code paths that pass user input to resume or session_id and reject dash-leading values until the update is in place.
• Monitor the GitHub advisory GHSA-h4mw-j7qp-8mwm for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-h4mw-j7qp-8mwm github.com
• Release v0.2.121 github.com
• Fix commit 347a1cb github.com
• Pull request #1123 github.com
• OSV GHSA-h4mw-j7qp-8mwm osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:17.