GHSA-h4mw-j7qp-8mwm: Claude Agent SDK resume argument injection

Evidence record

Security advisory describes untrusted resume session string becoming CLI options capable of loading an attacker-selected MCP server before model tool approval, fixed in SDK 0.2.121.

Read the original source ↗

Claim-level citations (4)

• supportsClaude Agent SDK resume identifier became an MCP startup option: The SDK forwarded an untrusted resume session value to CLI arguments, permitting leading flag interpretation such as MCP configuration selection.

  GHSA vulnerability details and argument passing

• supportsClaude Agent SDK resume identifier became an MCP startup option: The vendor advisory identifies versions before 0.2.121 as affected and version 0.2.121 as patched.

  GHSA affected and patched versions

• supportsClaude Agent SDK resume identifier became an MCP startup option: Under the documented application and flag-precondition, an attacker-selected stdio MCP command starts at CLI bootstrap before runtime model tool approval.

  GHSA impact and MCP startup sequence

• supportsClaude Agent SDK resume identifier became an MCP startup option: The documented exploit requires an application to accept an attacker-selected resume value; it is not a default unauthenticated attack on every SDK deployment.

  GitHub advisory GHSA-h4mw-j7qp-8mwm, description and attack preconditions