Claude Agent SDK fixes resume option parameter injection vulnerability; versions before 0.2.121 can be exploited for arbitrary command execution

A GitHub security advisory discloses that the Claude Agent SDK for Python lacks validation when passing the resume option to the Claude CLI; values starting with a hyphen are parsed as separate CLI flags. When an attacker controls the resume value, they can inject --mcp-config to define a stdio MCP server, execute arbitrary commands at CLI startup, and bypass the SDK's permission controls. The exploitation prerequisite is that the application passes untrusted input as the session ID to resume. Affected versions are claude-agent-sdk before 0.2.121, fixed in 0.2.121; vulnerability ID CVE-2026-96620, reported by hackerone.com/moamenmahmood.