{
  "@id": "urn:uuid:d32fc968-383d-4835-9670-3c1bac0b5460",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:57:00.153828+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40anthropic-ai/sdk@0.127.0",
          "identifiers": {
            "purl": "pkg:npm/%40anthropic-ai/sdk@0.127.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:56:00.255416+00:00",
      "status_notes": "Vulnerability CVE-2026-34451 does not affect version 0.127.0 of @anthropic-ai/sdk. not_affected \u2014 CVE-2026-34451 describes a path traversal vulnerability in the Anthropic TypeScript SDK's local filesystem memory tool where path validation used a string prefix check without a trailing path separator, allowing escape to sibling directories sharing the memory root's name as a prefix. Analysis confirms this vulnerability existed in earlier versions but was fixed by upstream commit bc1a2ff7 on M...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34451"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-34451 describes a path traversal vulnerability in the Anthropic TypeScript SDK's local filesystem memory tool where path validation used a string prefix check without a trailing path separator, allowing escape to sibling directories sharing the memory root's name as a prefix. Analysis confirms this vulnerability existed in earlier versions but was fixed by upstream commit bc1a2ff7 on M..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40anthropic-ai/sdk@0.127.0",
          "identifiers": {
            "purl": "pkg:npm/%40anthropic-ai/sdk@0.127.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:57:00.153828+00:00",
      "status_notes": "Vulnerability CVE-2026-41686 does not affect version 0.127.0 of @anthropic-ai/sdk. not_affected \u2014 CVE-2026-41686 describes insecure file permissions in BetaLocalFilesystemMemoryTool where memory files/directories were created with Node.js defaults (0o666/0o777), making them world-readable and potentially world-writable in permissive umask environments. The target repository (Anthropic TypeScript SDK v0.127.0) already contains the upstream security fix that explicitly sets restrictive permis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41686"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-41686 describes insecure file permissions in BetaLocalFilesystemMemoryTool where memory files/directories were created with Node.js defaults (0o666/0o777), making them world-readable and potentially world-writable in permissive umask environments. The target repository (Anthropic TypeScript SDK v0.127.0) already contains the upstream security fix that explicitly sets restrictive permis..."
    }
  ]
}