Executive brief
The Claude SDK for TypeScript includes a memory tool that stores and retrieves files from the local filesystem within a sandbox directory. A flaw in the path validation logic allowed attackers to escape this sandbox by crafting path names that reference sibling directories sharing the memory root's name as a prefix. An attacker using prompt injection could read and write files outside the intended sandbox boundary, potentially compromising sensitive application data and system files.
Technical details
The vulnerability is a path traversal flaw (CWE-22, CWE-41) in the local filesystem memory tool. The validatePath and validateNoSymlinkEscape functions used startsWith(resolvedRoot) without appending a trailing path separator, allowing a sibling directory like /memories_backup/ to pass a /memories prefix check. An attacker steered via prompt injection could supply crafted paths that would validate against the prefix check but resolve outside the sandboxed directory. This grants unauthorized read and write access to the filesystem. The fix, released in version 0.81.0, appends path.sep to the prefix check to ensure only actual child paths of the memory root are accepted.
Affected products
- Anthropic @anthropic-ai/sdk 0.79.0 to 0.80.x
Timeline
- 2026-03-31: disclosed: Vulnerability disclosed via GitHub advisory GHSA-5474-4w2j-mq4c
- 2026-03-31: patched: Fix released in SDK version 0.81.0 with path separator appended to prefix check
References
- https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-5474-4w2j-mq4c
- https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9
- https://github.com/anthropics/anthropic-sdk-typescript
- https://github.com/anthropics/anthropic-sdk-typescript/releases/tag/sdk-v0.81.0