CVE-2026-96620
1 advisory.
PyPI/claude-agent-sdk CVE-2026-96620: critical 9.2
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Action: Upgrade claude-agent-sdk to 0.2.121 or later.
pip install claude-agent-sdk==0.2.121Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.121 | - |
Fixed versions
| 0.2.121 |
Sources
- osv: GHSA-h4mw-j7qp-8mwm
- nvd: CVE-2026-96620
- https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm
- https://github.com/anthropics/claude-agent-sdk-python/pull/1123
- https://github.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d7652199399db1b7f914e0a459a6662
- https://github.com/anthropics/claude-agent-sdk-python
- https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121
CVE-2026-96620 · published · modified · JSON