Claude Sdk For Typescript CVE-2026-34451

The CVSS 4.0 score of 6.3 reflects moderate severity with several mitigating factors: the attack vector is network-based (AV:N) but requires high complexity (AC:H), suggesting an attacker must craft both the exploit path and successfully inject a prompt that causes the model to use it. Unauthenticated access (PR:N) means any user of the SDK is potentially exposed. The impact is limited to confidentiality and integrity of local files (VC:L, VI:L) with no availability impact. The CVSS vector indicates this is not a critical remote code execution, but rather a sandbox escape within a specific SDK feature. The presence of a publicly available GitHub commit hash and release tag (0.81.0) indicates the vendor has published a patch, reducing the window of exposure for organizations that update promptly. The real-world risk is contingent on deployment patterns: applications using the memory tool feature with untrusted model inputs (prompt injection vectors) face material risk; applications that do not use this specific tool or sanitize model inputs face minimal risk. The attack requires both successful prompt injection and knowledge of the path structure, making this a moderate-priority issue despite the moderate CVSS score.

An attacker crafts a prompt injection payload targeting an application using the vulnerable SDK's memory tool-for example, an application that allows user input to be included in prompts sent to Claude. The injected prompt steers the model to write sensitive data (API keys, credentials, database configurations) to a path like /app/memory-logs (where /app/memory is the intended sandbox root) or reads files from a sibling directory /app/memory_backups. Because the SDK's path validation only checks the string prefix /app/memory without a trailing separator, the request bypasses the sandbox and succeeds, exposing files outside the intended boundary. The attacker retrieves the leaked data via the model's response or subsequent file access.