CVE-2026-34451

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory. This issue has been patched in version 0.81.0.

• CWE-22
• CWE-41

• https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9Patch
• https://github.com/anthropics/anthropic-sdk-typescript/releases/tag/sdk-v0.81.0Release Notes
• https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-5474-4w2j-mq4cVendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34446Open Neural Network Exchange (ONNX) is an open standard for …5.5
• CVE-2026-34447Open Neural Network Exchange (ONNX) is an open standard for …5.5
• CVE-2026-34448SiYuan is a personal knowledge management system. Prior to v…9
• CVE-2026-34449SiYuan is a personal knowledge management system. Prior to v…9.6
• CVE-2026-3445The Paid Membership Plugin, Ecommerce, User Registration For…7.1
• CVE-2026-34450The Claude SDK for Python provides access to the Claude API …4.4
• CVE-2026-34452The Claude SDK for Python provides access to the Claude API …5.3
• CVE-2026-34453SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-34454OAuth2 Proxy is a reverse proxy that provides authentication…3.5
• CVE-2026-34455Hi.Events is an open-source event management and ticket sell…8.8
• CVE-2026-34456Reviactyl is an open-source game server management panel bui…9.8
• CVE-2026-34457OAuth2 Proxy is a reverse proxy that provides authentication…9.1