Claude Agent SDK for Python flaw lets a crafted session ID run commands (CVE-2026-96620)
CVE-2026-96620 (CVSS 4.0 9.2) lets an untrusted session ID passed to resume in claude-agent-sdk before 0.2.121 run commands. Fixed in July; no exploitation reported.
· 6 min