EUVD-2026-27087
GHSA-p7fg-763f-g4gf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privileges required to access filesystem; low C and I reflecting readable and (in permissive-umask environments) writable agent state; no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5Blast Radius
ecosystem impact- 48 npm packages depend on @anthropic-ai/sdk (47 direct, 1 indirect)
Ecosystem-wide dependent count for version 0.79.0.
DescriptionGitHub Advisory
The BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memory files and directories using the Node.js default modes (0o666 for files, 0o777 for directories), leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify memory files to influence subsequent model behavior.
Users on the affected versions are advised to update to the latest version.
Claude SDK thanks lucasfutures for the report.
AnalysisAI
Insecure default file permissions in the Anthropic TypeScript SDK's BetaLocalFilesystemMemoryTool expose persisted agent state to local read access and, in Docker deployments with permissive umasks, enable local users to overwrite memory files and manipulate subsequent model behavior. Affected versions span @anthropic-ai/sdk 0.79.0 through 0.91.0; a fix is available in 0.91.1. No public exploit exists and exploitation has not been observed (SSVC: none), with an EPSS score of 0.01% placing this in the 2nd percentile - risk is real but narrowly scoped to shared-host or containerized deployments.
Technical ContextAI
The BetaLocalFilesystemMemoryTool is a beta component in the @anthropic-ai/sdk npm package (CPE: pkg:npm/@anthropic-ai_sdk) that provides Claude agents with persistent local filesystem memory. The tool called Node.js filesystem APIs without specifying explicit permission modes, causing created files to inherit the Node.js platform defaults - 0o666 for files and 0o777 for directories. CWE-732 (Incorrect Permission Assignment for Critical Resource) describes this class of flaw precisely: permissions are assigned without regard for the sensitivity of the resource. On systems with a standard umask of 0022, files resolve to 0o644 (world-readable); in Docker base images that commonly set umask 0000 (or similarly permissive values), files resolve to 0o666 and directories to 0o777, making agent memory both globally readable and writable by any process or user in the container. This is particularly significant in multi-tenant or shared-pid-namespace container environments.
RemediationAI
Update @anthropic-ai/sdk to version 0.91.1 or later, which applies explicit restrictive permission modes when creating memory files and directories. The fix can be applied via npm install @anthropic-ai/sdk@^0.91.1 or equivalent. The GitHub Security Advisory is at https://github.com/anthropics/anthropic-sdk-typescript/security/advisories/GHSA-p7fg-763f-g4gf. If an immediate upgrade is not possible, restrict access to the directory used by BetaLocalFilesystemMemoryTool by manually applying chmod 700 to the memory directory after creation - this removes world-read and world-write access but requires re-application whenever the directory is recreated. In Docker deployments, explicitly set umask 0027 or stricter in the container entrypoint to mitigate the world-writable directory condition; note this affects all file creation in the process, not only SDK memory. Do not rely on Docker network isolation alone, as the threat model involves intra-container local access.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today