Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Anthropic SDKs

CVE-2026-34451: Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

mediumCVSS 4.0 6.3 · 3.1 5.4GHSA-5474-4w2j-mq4c

The local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory.

Published Apr 1, 2026 · Updated Apr 24, 2026

Affected packages

@anthropic-ai/sdk

Ecosystem
npm
Affected
>= 0.79.0, < 0.81.0
Fixed in
0.81.0
Check
npm ls @anthropic-ai/sdk

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory.

Users on the affected versions are advised to update to the latest version.

Claude SDK for TypeScript thanks hackerone.com/nicksim for reporting this issue!

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Anthropic SDKs vulnerabilities

All Anthropic SDKs entries