The vulnerability occurs when the Claude Agent SDK passes the resume option to its underlying CLI without input validation. A session ID beginning with a dash is interpreted as an independent flag, permitting an attacker to inject the --mcp-config option and define a malicious stdio MCP server. This enables arbitrary commands to run on the host when the CLI starts, bypassing the SDK's permission controls. The flaw involves unchecked input, command injection, and privilege escalation, corresponding to CWE‑20, CWE‑78, and CWE‑88.

Anthropics Claude Agent SDK for Python is affected. All releases prior to version 0.2.121 are vulnerable. Versions at or above 0.2.121 contain the fix.

The CVSS v3 base score is 9.2, indicating critical severity. No EPSS score is published, and the vulnerability is not listed in CISA's KEV catalog, but the lack of public exploitation data does not mitigate the inherent risk. The attack requires that an application provide a malicious session ID to the resume feature; thus, any container or orchestration workload that uses the SDK with untrusted input is at risk. Exploitation is straightforward from local or remote code that controls the session ID, and CLIs that start with the injected flag can spawn arbitrary commands.