PT-2026-29379 · Anthropic · Claude Sdk For Typescript

Nicksim · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34451

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Claude SDK for TypeScript versions 0.79.0 through 0.80.9

Description The Claude SDK for TypeScript, used for accessing the Claude API in TypeScript and JavaScript applications, had a flaw in the local filesystem memory tool. Between versions 0.79.0 and before 0.81.0, the path validation process used a string prefix check that lacked a trailing path separator. This allowed a crafted path, supplied through prompt injection, to resolve to a directory outside the intended sandbox, potentially enabling unauthorized read and write access.

Recommendations Update to version 0.81.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-41

Related Identifiers

CVE-2026-34451

GHSA-5474-4W2J-MQ4C

Affected Products

Claude Sdk For Typescript

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34451.json · Exploit
• https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9 · Patch
• https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-5474-4w2j-mq4c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34451 · Security Note
• https://osv.dev/vulnerability/GHSA-5474-4w2j-mq4c · Vendor Advisory
• https://github.com/anthropics/anthropic-sdk-typescript · Note
• https://github.com/anthropics/anthropic-sdk-typescript/releases/tag/sdk-v0.81.0 · Note
• https://twitter.com/CVEnew/status/2039372099236614425 · Twitter Post