CVE-2026-34451 — MEDIUM | AI Threat Alert

Q: Is CVE-2026-34451 actively exploited?

No confirmed active exploitation of CVE-2026-34451 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-34451?

1) Upgrade @anthropic-ai/sdk to 0.81.0 immediately — the fix appends a trailing path separator before the prefix check, closing the traversal. 2) If patching is blocked, disable or remove the local filesystem memory tool from agent configurations entirely. 3) Apply OS-level sandboxing (seccomp profiles, containers with read-only mounts, restricted filesystem namespaces) as defense-in-depth regardless of SDK version. 4) Audit all agent pipelines for untrusted content ingestion paths that could deliver indirect prompt injection payloads. 5) Monitor filesystem access logs for anomalous reads/writes originating from the agent process. 6) Add integration tests asserting the memory tool cannot access paths outside its configured root.

Q: What systems are affected by CVE-2026-34451?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, agentic coding assistants, document processing pipelines, email and calendar agents.

Q: What is the CVSS score for CVE-2026-34451?

No CVSS score has been assigned yet.

CISO Take

The Anthropic TypeScript SDK's local filesystem memory tool fails to properly sandbox model-supplied paths, allowing a prompt-injected model to traverse outside the intended memory directory and read or write arbitrary files on the host. Any agentic application using @anthropic-ai/sdk 0.79.0–0.80.x that processes untrusted content is at material risk of credential theft or data exfiltration. Patch to 0.81.0 immediately and audit agent pipelines for prompt injection entry points.

What is the risk?

Medium severity on paper, but contextually elevated for agentic deployments. Exploitation requires chaining prompt injection — common in content-processing agents — with a path crafting step, placing it at moderate skill threshold. Impact is high: unrestricted read/write to the host filesystem enables credential theft, config exfiltration, or persistent backdoor placement. Low EPSS (0.00044) indicates no active mass exploitation, but targeted attacks against known agentic deployments using this SDK version are plausible and technically straightforward once the injection vector is established.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
@anthropic-ai/sdk	npm	>= 0.79.0, < 0.81.0	`0.81.0`
1.9K 240 dependents Pushed 8d ago 67% patched ~3d to patch Full package profile →

Do you use @anthropic-ai/sdk? You're affected.

Severity & Risk

CVSS 3.1

N/A

EPSS

0.1%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade @anthropic-ai/sdk to 0.81.0 immediately — the fix appends a trailing path separator before the prefix check, closing the traversal. 2) If patching is blocked, disable or remove the local filesystem memory tool from agent configurations entirely. 3) Apply OS-level sandboxing (seccomp profiles, containers with read-only mounts, restricted filesystem namespaces) as defense-in-depth regardless of SDK version. 4) Audit all agent pipelines for untrusted content ingestion paths that could deliver indirect prompt injection payloads. 5) Monitor filesystem access logs for anomalous reads/writes originating from the agent process. 6) Add integration tests asserting the memory tool cannot access paths outside its configured root.

CISA SSVC Assessment

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Prompt Injection Data Extraction Code Execution Framework Agent API AML.T0010.001 - AI Software AML.T0037 - Data from Local System AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0080.000 - Memory AML.T0086 - Exfiltration via AI Agent Tool Invocation

Compliance Impact

This CVE is relevant to:

EU AI Act

Art.15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI Risk Assessment A.9.3 - AI System Security Controls

NIST AI RMF

GOVERN 1.7 - AI Risk Identification and Management Processes MEASURE 2.5 - AI System Testing for Trustworthiness

OWASP LLM Top 10

LLM01:2025 - Prompt Injection LLM05:2025 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-34451?

The Anthropic TypeScript SDK's local filesystem memory tool fails to properly sandbox model-supplied paths, allowing a prompt-injected model to traverse outside the intended memory directory and read or write arbitrary files on the host. Any agentic application using @anthropic-ai/sdk 0.79.0–0.80.x that processes untrusted content is at material risk of credential theft or data exfiltration. Patch to 0.81.0 immediately and audit agent pipelines for prompt injection entry points.

Is CVE-2026-34451 actively exploited?

No confirmed active exploitation of CVE-2026-34451 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34451?

1) Upgrade @anthropic-ai/sdk to 0.81.0 immediately — the fix appends a trailing path separator before the prefix check, closing the traversal. 2) If patching is blocked, disable or remove the local filesystem memory tool from agent configurations entirely. 3) Apply OS-level sandboxing (seccomp profiles, containers with read-only mounts, restricted filesystem namespaces) as defense-in-depth regardless of SDK version. 4) Audit all agent pipelines for untrusted content ingestion paths that could deliver indirect prompt injection payloads. 5) Monitor filesystem access logs for anomalous reads/writes originating from the agent process. 6) Add integration tests asserting the memory tool cannot access paths outside its configured root.

What systems are affected by CVE-2026-34451?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, agentic coding assistants, document processing pipelines, email and calendar agents.

What is the CVSS score for CVE-2026-34451?

No CVSS score has been assigned yet.

Technical Details

NVD Description

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory. This issue has been patched in version 0.81.0.

Exploitation Scenario

An attacker publishes a document or web page containing an indirect prompt injection payload. When the Claude agent processes this content — via RAG retrieval, email summarization, or a browsing task — the injected instruction directs the model to invoke the filesystem memory tool with a crafted path such as '/opt/app-memory-secrets/db.env', where 'app-memory-secrets' passes the naive prefix check against configured root '/opt/app-memory' because no trailing separator is enforced. The SDK resolves the path outside the sandbox, and the model returns or stores the file contents. The attacker retrieves exfiltrated credentials or secrets through the agent's normal output channel with no filesystem-level alerts triggered.