CVE-2026-96620

Claude Agent SDK CLI Argument Injection Flaw CVE-2026-96620 Enables Arbitrary Command Execution via Malicious MCP Server Configuration

Anthropic resolves a critical argument injection defect in Claude Agent SDK (CVE-2026-96620, CVSS 9.2) that allows untrusted session parameters to execute arbitrary OS commands.