CVE-2026-34451

Katalog CVE

CVSS 5.4 · Medium EPSS 0,39%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada anthropic claude sdk for typescript. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory. This issue has been patched in version 0.81.0.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-41: Improper Resolution of Path Equivalence

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-5474-4w2j-mq4c advisory vendor
• https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9 patch
• https://github.com/anthropics/anthropic-sdk-typescript/releases/tag/sdk-v0.81.0 release notes