Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| claude-agent-sdk | pip | < 0.2.121 | 0.2.121 |
Miggo AIRoot Cause AnalysisThe vulnerability is an argument-injection flaw in the Python Claude Agent SDK's subprocess transport. The root cause is in SubprocessCLITransport._build_command, which builds the command-line argument list for the Claude CLI. In vulnerable versions (< 0.2.121), the resume option was passed as two separate argv tokens (["--resume", value]). Since the CLI declares --resume as an optional-value flag, a dash-prefixed value (e.g. --mcp-config) is interpreted by the CLI's argument parser as a separate flag rather than as the value of --resume. This allows an attacker who controls the resume value to inject arbitrary CLI flags, including --mcp-config with a stdio MCP server definition, resulting in arbitrary command execution at CLI startup. The fix (commit 347a1cb88d7652199399db1b7f914e0a459a6662) changes the emission to the single-token --resume=<value> form, which always binds the value to the flag so the CLI rejects dash-leading values as invalid session IDs. The same change was applied to --session-id for uniformity. The only production function modified by the patch is SubprocessCLITransport._build_command, which is the function that would appear in a runtime profile/stack trace during exploitation.
SubprocessCLITransport._build_commandsrc/claude_agent_sdk/_internal/transport/subprocess_cli.py