GHSA-w828-4qhx-vxx3

Suggest an improvement
Source
https://github.com/advisories/GHSA-w828-4qhx-vxx3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w828-4qhx-vxx3/GHSA-w828-4qhx-vxx3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w828-4qhx-vxx3
Aliases
Downstream
CGA (4)
ECHO (1)
Published
2026-04-01T21:17:34Z
Modified
2026-09-10T03:51:03Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
Details

The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a symlink between validation and use, causing reads or writes to escape the sandbox. The synchronous memory tool implementation was not affected.

Users on the affected versions are advised to update to the latest version.

Claude SDK for Python thanks hackerone.com/kasthelord for reporting this issue!

Database specific 
{
    "cwe_ids":  [
        "CWE-367",
        "CWE-59"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-01T21:17:34Z",
    "nvd_published_at":  "2026-03-31T22:16:20Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / anthropic

Package

Name
anthropic
View open source insights on deps.dev
Purl
pkg:pypi/anthropic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.86.0
Fixed
0.87.0

Affected versions

0.*
0.86.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w828-4qhx-vxx3/GHSA-w828-4qhx-vxx3.json"