CVE-2026-41686General(anthropic / claude_sdk_for_typescript)

LOWCVSS 4.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memory files and directories using the Node.js default modes (0o666 for files, 0o777 for directories), leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify memory files to influence subsequent model behavior. This issue has been patched in version 0.91.1.

anthropic CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-p7fg-763f-g4gf

Weakness type (CWE)

CWE-732

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

claude_sdk_for_typescript

Threat summary

5 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
General: 4 classified signals
Disclosure: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-05-27)
5 total mentions across 4 days

Affected systems

Vendors

anthropic

Products

claude_sdk_for_typescript

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

General

480.0%

Disclosure

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-01	1	Disclosure1
2026-05-04	1	General1
2026-05-05	1	General1
2026-05-27	2	General2

Full discourse5 posts

Lyrie.ai@lyrie_ai134d
General
The AI Agent Memory Crisis: When Your Agent's Brain Becomes a Perimeter Breach On April 29, 2026, Anthropic disclosed CVE-2026-41686, a vulnerability in the official Claude SDK for TypeScript.
Post summary
Anthropic disclosed CVE-2026-41686 as a vulnerability in its Claude SDK for TypeScript, but no additional details on exploitation, patch, or technical specifics are provided.
1001054
227 followersView on X
Lyrie.ai@lyrie_ai134d
General
CVE-2026-41686 · v0.79.0 → 0.91.0 The AI Agent Memory Crisis: When Your Agent's Brain Becomes a Perimeter Breach
Post summary
The content references CVE-2026-41686 with a version range but provides no further details about exploitation, mitigation, or technical characteristics.
1001047
227 followersView on X
CVE@CVEnew157d
General
CVE-2026-41686 Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the … https://www.cve.org/CVERecord?id=CVE-2026-41686
Post summary
The text merely flags CVE-2026-41686 for the Claude TypeScript SDK and links to the CVE record, without providing exploitation details, patches, or technical vulnerability information.
00010155
57.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds157d
General
CVE-2026-41686 Information Disclosure in Anthropic TypeScript SDK BetaLocalFilesystemMemoryTool Versions 0.79.0-0.91.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41686
Post summary
A brief CVE announcement noting an information disclosure in Anthropic TypeScript SDK, but lacking PoC, exploit, or mitigation details.
0000040
4.0K followersView on X
DailyCVE@dailycve161d
Disclosure
🟠 Claude SDK for TypeScript, Insecure Default File Permissions, #CVE-2026-41686 (Medium) https://dailycve.com/claude-sdk-for-typescript-insecure-default-file-permissions-cve-2026-41686-medium/
Post summary
The post announces CVE-2026-41686 for the Claude SDK, noting insecure default file permissions and medium severity, but offers no PoC, exploit, patch, or active exploitation details.
0000039
192 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	anthropic	claude_sdk_for_typescript	-	-	-

Explore more

Back to dashboard anthropic CVEs claude_sdk_for_typescript vulnerabilities

What researchers are saying

CVE-2026-41686

Lyrie.ai[verified]@lyrie_aiGeneral

Anthropic disclosed CVE-2026-41686 as a vulnerability in its Claude SDK for TypeScript, but no additional details on exploitation, patch, or technical specifics are provided.

Lyrie.ai[verified]@lyrie_aiGeneral

The content references CVE-2026-41686 with a version range but provides no further details about exploitation, mitigation, or technical characteristics.

CVE@CVEnewGeneral

The text merely flags CVE-2026-41686 for the Claude TypeScript SDK and links to the CVE record, without providing exploitation details, patches, or technical vulnerability information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

A brief CVE announcement noting an information disclosure in Anthropic TypeScript SDK, but lacking PoC, exploit, or mitigation details.

DailyCVE@dailycveDisclosure

The post announces CVE-2026-41686 for the Claude SDK, noting insecure default file permissions and medium severity, but offers no PoC, exploit, patch, or active exploitation details.