CVE-2026-96620 / GHSA-h4mw-j7qp-8mwm (critical), claude-agent-sdk (Python) < 0.2.121. The SDK passed the resume option to the Claude CLI without validation, so a value starting with - was read as a separate CLI flag. An attacker who controlled the resume value could inject --mcp-config defining a stdio MCP server. That gave arbitrary command execution at CLI startup and bypassed the SDK's permission controls. It's only exploitable if an application passes untrusted input, such as a session ID from a web request, as the session to resume. Fixed in 0.2.121 (reported via HackerOne by moamenmahmood). Published Oct 16.

CVE-2026-86063 / GHSA-pq7j-f95f-qfcv (high), @anthropic-ai/claude-code < 2.1.179. The plugin install flow in Claude Code and Claude Desktop ran git checkout on a marketplace's pinned commit SHA but didn't verify that HEAD matched it afterwards. An attacker who controls a plugin's upstream repo could create a branch named exactly like the 40-character SHA, and the checkout would silently resolve to the attacker's branch tip. Exploitation needs a user to install a malicious plugin pinned to a safe hash, hosted on a git host that allows SHA-shaped branch names. Auto-updating installs already have the fix. Reported by Or Nevo Michrowski of Air Security. Published Oct 15.

Do now: pip show claude-agent-sdk in every service that wraps Claude Code, upgrade to 0.2.121+, and never pass request-derived strings into resume, cwd or other CLI-bound options without strict validation (for example, a UUID regex). For Claude Code, run claude --version on machines with manual updates. The general lesson for any harness: arguments that become CLI flags are an injection surface, and a pinned hash only means something if you verify the checked-out commit.