GHSA-p7fg-763f-g4gf
NoneCVSS
—
EPSS
—
Published
Apr 29, 2026
CISA due date
—
The record
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @anthropic-ai/sdk | 0.79.0 | 0.91.1 |
Related vulnerabilities
- CVE-2026-41686 Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript… Same vulnerability
- GHSA-5474-4w2j-mq4c Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling… Also affects @anthropic-ai/sdk
- CVE-2026-34451 Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript… Also affects @anthropic-ai/sdk
- CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-732
- CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code… CWE-732
- CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass… CWE-732
- CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissions. CWE-732
- CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM… CWE-732