$ the-wire · showcase
Argument injection in claude-agent-sdk-python, mod test harness lands in claude-code
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
2 people shipped this
The Python Agent SDK carries a command execution vulnerability in how the resume option is handled, while claude-code shipped a test harness that runs mod unit tests against the engine's own bindings.
The Python Agent SDK's resume option allows argument injection that leads to arbitrary command execution, and the GitHub advisory carries no version, no CVE, and no patch reference to verify against [1]. Until Anthropic publishes an affected-version range and a fixed release, treat any caller that moves untrusted input into resume as attacker-controlled. The same repository bumped its bundled CLI to 2.1.270 [2], but that is a routine version sync, not a stated fix for the injection.
claude-code landed unit tests for the diff, sec-default, and telemetry mods, typed against the plugin declarations [3]. Tests now run where the mod runs: each test is handed the engine's own `$` and the same `on` a hooks module gets, registers what the mod needs beneath it (`mock.clock`, `mock.store`, `mock.env`, or plain hooks), and drives the mod through `$`. `claude plugin test <dir>` runs them, and the kit's types ship as `claude-code/testing` inside `mods/types/claude-code.d.ts`, which `/plugin-types` regenerates. `mods/tsconfig.json` typechecks every mod's hooks and tests against those declarations, so a mod whose hooks drift from the shipped types fails the typecheck rather than at runtime.
A follow-up made telemetry's types path ./-relative like the other manifest paths [4]. If your manifest mixed relative and non-relative entries for types, normalizing on ./ is the convention now; the merge of the mod-tests work followed [5].
On the action side, claude-code-action bumped Claude Code to 2.1.270 and Agent SDK to 0.3.270 [6], and claude-code-base-action synced from that same commit [7]. That is a dependency bump in lockstep across both actions, nothing more. claude-agent-sdk-typescript updated its CHANGELOG.md [8].
Action items
- → Audit every caller that passes external input into the Python Agent SDK resume option until Anthropic publishes an affected-version range and fix anthropics/claude-agent-sdk-python [immediate]
- → Run `claude plugin test <dir>` against diff, sec-default, and telemetry mods and add `mods/tsconfig.json` typechecking to CI anthropics/claude-code [plan]
- → Bump claude-code-action and claude-code-base-action to the 2.1.270 / 0.3.270 pins anthropics/claude-code-action [monitor]
References
- [1] Argument Injection via resume Option Allows Arbitrary Command Execution anthropics/claude-agent-sdk-python ↗
- [2] chore: bump bundled CLI version to 2.1.270 ↗ anthropics/claude-agent-sdk-python
- [3] mods: unit tests for diff, sec-default and telemetry, typed against the plugin declarations ↗ anthropics/claude-code
- [4] mods: telemetry's types path is ./-relative like the other manifest paths (#93932) ↗ anthropics/claude-code
- [5] Merge pull request #93912 from anthropics/poteat/mod-tests-seat ↗ anthropics/claude-code
- [6] chore: bump Claude Code to 2.1.270 and Agent SDK to 0.3.270 ↗ anthropics/claude-code-action
- [7] Sync from claude-code-action base-action@9cdae7f ↗ anthropics/claude-code-base-action
- [8] chore: Update CHANGELOG.md ↗ anthropics/claude-agent-sdk-typescript
