Evidence record / claude-code
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fix
Python SDK resume injection enters NVD after its July fix. NVD published CVE-2026-96620 at 2026-10-16T20:18:28.293Z and modified it at 2026-10-21T22:16:50.597Z. The canonical advisory was already public on 12 September. Python claude-agent-sdk below 0.2.121 passed an untrusted resume ID as a separate CLI argument: an attacker-controlled dash-leading ID could inject an MCP configuration and execute a stdio server at startup outside SDK permission controls. The July fix binds resume/session-id values with an equals sign.
Channel: tagged-release. Half: defect. Date: 2026-10-16.
Operator consequence: Check the installed Python SDK dependency separately from the CLI pin, especially applications accepting resume IDs from requests. Use a fixed SDK, 0.2.121 or later. This is a newly indexed disclosure of an older fixed boundary, not a new CLI 310 vulnerability or proof that upgrading the CLI repairs an old SDK.
Receipt
- https://nvd.nist.gov/vuln/detail/CVE-2026-96620
- https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-96620
- https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm
- https://github.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d7652199399db1b7f914e0a459a6662
- https://github.com/anthropics/claude-agent-sdk-python/compare/347a1cb88d7652199399db1b7f914e0a459a6662…v0.2.121
- https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121
- https://pypi.org/pypi/claude-agent-sdk/0.2.121/json
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fix
Profile citations
- Claude Code / claim / python-sdk-resume-injection
- Claude Code / posture / governance
Source links
Primary links, including exact changelog lines when available.
- official docs2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixnvd.nist.gov/vuln/detail/CVE-2026-96620official docs2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixservices.nvd.nist.gov/rest/json/cves/2.0official docs2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixgithub.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwmcommit2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixgithub.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d7652199399db1b7f914e0a459a6662git compare2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixgithub.com/anthropics/claude-agent-sdk-python/compare/347a1cb88d7652199399db1b7f914e0a459a6662...v0.2.121github release2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixanthropics/claude-agent-sdk-python / v0.2.121package registry2026-10-24-claude-code-python-sdk-resume-injection-enters-nvd-after-its-july-fixpypi.org/pypi/claude-agent-sdk/0.2.121/json
Versioned source: run artifact