{"action":"Upgrade claude-agent-sdk to 0.2.121 or later.","affected":[{"fixed":"0.2.121","introduced":"0"}],"component":"claude-agent-sdk","cve_ids":["CVE-2026-96620"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.2.121"],"ghsa_id":"GHSA-h4mw-j7qp-8mwm","id":"tcs_01M5JHHS6T8NKQJDWQMPDBGWSJ","modified_at":"2026-10-16T20:00:04.101685566Z","published_at":"2026-10-16T19:44:37Z","references":["https://osv.dev/vulnerability/GHSA-h4mw-j7qp-8mwm","https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm","https://github.com/anthropics/claude-agent-sdk-python/pull/1123","https://github.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d7652199399db1b7f914e0a459a6662","https://github.com/anthropics/claude-agent-sdk-python","https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121"],"severity":{"label":"critical","score":9.2},"sources":[{"source":"osv","source_id":"GHSA-h4mw-j7qp-8mwm","url":"https://osv.dev/vulnerability/GHSA-h4mw-j7qp-8mwm"},{"source":"nvd","source_id":"CVE-2026-96620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96620"}],"summary":"Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution"}