What happened
A CVSS 9.2 (v4.0) argument-injection flaw in SubprocessCLITransport._build_command: the resume option is passed to the Claude CLI as a separate argv token without validation, so a dash-leading value is parsed as a new CLI flag. An attacker can inject the --mcp-config flag to register a stdio MCP server and achieve arbitrary command execution at CLI startup, bypassing the SDK's permission gates. Fixed in 0.2.121; NVD REST verified (published 2026-10-16).
Why it matters
This converts a common agent-automation pattern — resuming a Claude Code session with an externally-supplied session ID — into arbitrary code execution on the machine that runs the agent. It is a novel CLI-flag-injection attack class in Anthropic's own SDK: the agent's guardrails never see or approve the injected MCP server, so a poisoned session reference taken from a web request, message, or prompt-injected document can silently run attacker code with the user's full Claude Code permissions.
Attack vector
The subprocess transport builds the Claude CLI argv as two separate tokens (["--resume", value]). Because the CLI treats dash-leading values as new flags, an attacker who controls the resume value can inject --mcp-config to define a stdio MCP server, so arbitrary commands run at CLI startup outside the SDK's permission controls. Triggered when an app resumes a session with attacker-influenced input.
Affected systems
anthropics/claude-agent-sdk-python < 0.2.121
Mitigation
Upgrade to claude-agent-sdk-python 0.2.121 (commit 347a1cb; GHSA-h4mw-j7qp-8mwm). The fix emits --resume=<value> as a single token so dash-leading values are rejected as invalid session IDs; --session-id was hardened identically. Treat any caller-supplied session/resume identifier as untrusted until upgraded.