External risk intelligence

Claude Agent SDK Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-96620

The vulnerability exists in a Python SDK used for CLI tool development. Exploitation requires an application using the SDK to pass untrusted input as a session ID. While the CLI can be network-accessible, SDKs are typically developer-focused tools or internal library components. Public internet exposure of a specific CLI session identifier in a way that allows injection is uncommon and requires specific application-level implementation.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Claude Agent SDK for Python, impacting how it handles session data when resuming operations. If an application passes untrusted input as a session identifier, an attacker could potentially inject commands that execute when the command-line interface starts, bypassing standard security controls.

Untrusted input could allow command execution.
This impacts applications using the SDK with unvalidated session data.
Confirm if your operations pass untrusted session data.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking an application into using a specially crafted session ID. This malicious input, when passed to the Claude Agent SDK, could be interpreted as a command-line flag, allowing the attacker to execute arbitrary commands on the system when the Claude CLI starts. This bypasses the SDK's normal security controls.

Application passes untrusted input as session ID.
Malicious input is parsed as a CLI flag.
Arbitrary command execution is possible.

Live Threat

Current exploitation, exposure, and threat context

When an application passes untrusted input as a session ID to the Claude Agent SDK, an attacker could inject a malicious flag at CLI startup. This could lead to arbitrary command execution, bypassing SDK permission controls.

Command execution on the system.
Untrusted session ID passed to SDK.
System compromise and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation likely involves application owners and platform teams responsible for systems utilizing the Claude Agent SDK. The first practical step is to identify all applications that pass untrusted input as a session ID to the Claude CLI and confirm their business criticality and network exposure. Once identified, assess the risk and plan remediation, which may involve coordinating with development teams or the vendor.

Application owners should lead remediation.
Verify untrusted input used as session ID.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Claude Agent SDK?

The Claude Agent SDK is a specialized Python library designed to help developers build and manage agentic workflows for Claude Code. It provides the necessary hooks and utilities for interacting with the Claude CLI, allowing programs to programmatically start, resume, and configure agent sessions through the command line.

Why is CVE-2026-96620 a command injection vulnerability?

This vulnerability falls under Improper Neutralization of Special Elements, specifically related to argument injection. Because the SDK fails to validate user input when resuming a session, a crafted string can trick the software into treating it as a new CLI command flag. This allows an attacker to inject unauthorized instructions, such as configuration overrides, which the system executes with higher privileges than intended.

How does an attacker trigger this bug?

An attacker triggers the vulnerability by supplying a malicious, dash-leading string as a session ID to an application that uses the SDK. The flaw is not triggered when the session ID contains standard alphanumeric characters or is managed internally by trusted services. It specifically requires an application to take input from an untrusted source and pass it directly to the SDK without sanitization.

Do I need to worry if my application is not internet-facing?

Halo Surface Signal indicates that while the vulnerability is technically network-accessible, the risk is typically lower for internal tools. The main concern is whether your application accepts and processes input from external or untrusted users that eventually reaches the Claude Agent SDK. If your infrastructure only handles strictly internal, validated data, the likelihood of an attacker successfully injecting malicious flags remains low.

How do I secure my systems against this CVE?

Your first step is to inventory all applications utilizing the Claude Agent SDK to determine if any pass user-supplied data into session handling routines. Once identified, ensure these applications are updated to version 0.2.121 or later, which includes necessary input validation. If an immediate update is not feasible, restrict the source of session identifiers to trusted, hardcoded, or sanitized values to prevent flag injection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.