PT-2026-36109 · Anthropic · Claude Sdk For Typescript

Lucasfutures · Published 2026-04-29 · Updated 2026-05-27 · CVE-2026-41686

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Claude SDK for TypeScript versions 0.79.0 through 0.91.0

Description The BetaLocalFilesystemMemoryTool creates memory files and directories using Node.js default modes (0o666 for files and 0o777 for directories). This results in files being world-readable on systems with a standard umask and world-writable in environments with permissive umasks, such as certain Docker base images. A local attacker on a shared host could read persisted agent state, or in containerized deployments, modify memory files to influence subsequent model behavior.

Recommendations Update to version 0.91.1.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2026-41686

GHSA-P7FG-763F-G4GF

Affected Products

Claude Sdk For Typescript

References · 11

• https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-p7fg-763f-g4gf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p7fg-763f-g4gf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41686 · Security Note
• https://github.com/anthropics/anthropic-sdk-typescript · Note
• https://twitter.com/lyrie_ai/status/2059586988571853095 · Twitter Post
• https://twitter.com/CVEnew/status/2051383964108001365 · Twitter Post
• https://t.me/cveNotify/162072 · Telegram Post
• https://twitter.com/dailycve/status/2050026730979492273 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051552125092532517 · Twitter Post
• https://twitter.com/lyrie_ai/status/2059586989385531634 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1szui9p/resumen_diario_de_vulnerabilidades_30042026 · Reddit Post