Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls.
The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
anthropics:claude-agent-sdk-python
References 4
https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-…
https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm
https://github.com/anthropics/claude-agent-sdk-python/pull/1123
https://github.com/anthropics/claude-agent-sdk-python/pull/1123
https://github.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d76521993…
https://github.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d7652199399db1b7f914e0a459a6662
https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121
https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121