// ClaudeCRITICAL
CVE-2026-96620 is a critical input validation vulnerability (CVSS 9.2) in claude-agent-sdk-python versions before 0.2.121. An attacker can inject the --mcp-config flag via untrusted session IDs to define a stdio MCP server, enabling arbitrary command execution at CLI startup outside SDK permission controls. The vulnerability was disclosed and fixed on October 16, 2026.
- CVE-2026-96620: claude-agent-sdk-python Input Validation Flaw(opens in a new tab)
- Argument Injection in Claude Agent SDK via --resume Allows Arbit(opens in a new tab)
// Get alerts for Claude