One leading dash turned a session id into a flag

The Python Claude Agent SDK passed the resume option to the Claude CLI without validating it. The option carries a session id. When the value began with a dash, the CLI parsed it as a separate flag rather than a session id. An attacker who controlled that value could supply --mcp-config, which defines a stdio MCP server the CLI starts at launch.

That is the whole bypass. A stdio MCP server entry is a command line, and the CLI runs it. The SDK's permission controls sat above this step, so the injected server started before any of them applied. The flaw is argument injection: an untrusted string reached a command line, and the leading dash changed how it was read.

Exploiting it needs an application that passes untrusted input as the session id. That is a narrow condition. The advisory rates the flaw 9.8 on CVSS, with the network attack vector and no privileges or user interaction required. The score describes the severity once the precondition holds, not how often it holds.

The GitLab advisory, the GHSA record, and the NVD entry describe the same flaw. The CWEs it lists are 20, 78, and 88: improper input validation, improper neutralization of special elements in OS commands, and argument injection. The reporter is credited as moamenmahmood.

The patch validated the session id before the CLI saw it. The fix shipped as pull request 1123, commit 347a1cb, and version 0.2.121. Every release below 0.2.121 carried the flaw.

**Log take:** The severity is real, but the interesting part is where the trust broke. The SDK treated a session id as data; the CLI treated the same string as instructions. *(Interpretation; vendor and advisory sources, single flaw.)*