claude-agent-sdk-python vulnerabilities

CVEs whose affected-version data names the claude-agent-sdk-python package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-96620Critical· 9.2

2w ago

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can injec…

▾ Midnightanthropics · claude-agent-sdk-pythonEPSS 0.70%via CVEORG