---
title: Two Anthropic harness advisories: Claude Agent SDK for Python let an untrusted 'resume' value inject --mcp-config and run commands (CVE-2026-96620, critical), and Claude Code plugin hash pins could be dodged with a SHA-named branch (CVE-2026-86063) | ctxsec
url: https://ctxsec.com/items/anthropic-agent-sdk-resume-mcp-config-claude-code-plugin-pin
description: ""
status: "confirmed (GitHub advisories GHSA-h4mw-j7qp-8mwm and GHSA-pq7j-f95f-qfcv); backfill (published Oct 15-16)"
published: 2026-10-20
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/anthropic-agent-sdk-resume-mcp-config-claude-code-plugin-pin.md)

confirmed (GitHub advisories GHSA-h4mw-j7qp-8mwm and GHSA-pq7j-f95f-qfcv); backfill (published Oct 15-16)

2026-10-20

### Two Anthropic harness advisories: Claude Agent SDK for Python let an untrusted 'resume' value inject --mcp-config and run commands (CVE-2026-96620, critical), and Claude Code plugin hash pins could be dodged with a SHA-named branch (CVE-2026-86063)

**CVE-2026-96620 / GHSA-h4mw-j7qp-8mwm (critical), claude-agent-sdk (Python) < 0.2.121.** The SDK passed the `resume` option to the Claude CLI without validation, so a value starting with `-` was read as a separate CLI flag. An attacker who controlled the resume value could inject `--mcp-config` defining a **stdio MCP server**. That gave arbitrary command execution at CLI startup and bypassed the SDK's permission controls. It's only exploitable if an application passes untrusted input, such as a session ID from a web request, as the session to resume. Fixed in 0.2.121 (reported via HackerOne by moamenmahmood). Published Oct 16.

**CVE-2026-86063 / GHSA-pq7j-f95f-qfcv (high), @anthropic-ai/claude-code < 2.1.179.** The plugin install flow in Claude Code and Claude Desktop ran `git checkout` on a marketplace's pinned commit SHA but didn't verify that HEAD matched it afterwards. An attacker who controls a plugin's upstream repo could create a **branch named exactly like the 40-character SHA**, and the checkout would silently resolve to the attacker's branch tip. Exploitation needs a user to install a malicious plugin pinned to a safe hash, hosted on a git host that allows SHA-shaped branch names. Auto-updating installs already have the fix. Reported by Or Nevo Michrowski of Air Security. Published Oct 15.

**Do now:** `pip show claude-agent-sdk` in every service that wraps Claude Code, upgrade to 0.2.121+, and never pass request-derived strings into `resume`, `cwd` or other CLI-bound options without strict validation (for example, a UUID regex). For Claude Code, run `claude --version` on machines with manual updates. The general lesson for any harness: arguments that become CLI flags are an injection surface, and a pinned hash only means something if you verify the checked-out commit.

Sources: [GHSA-h4mw-j7qp-8mwm (Claude Agent SDK)](https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm) · [GHSA-pq7j-f95f-qfcv (Claude Code)](https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv) · [claude-agent-sdk-python v0.2.121](https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.121)