The vulnerability exists in the memory tool of the Anthropic TypeScript SDK. The SDK validates model supplied paths with a string prefix check that fails to enforce a trailing separator, enabling a crafted path to resolve to a sibling directory of the sandboxed memory root. This allows an attacker who can influence the model’s prompt to read or write files outside the intended sandbox, potentially leaking sensitive data or modifying configuration files. The weakness corresponds to path traversal and restricted resource access.

The issue affects the anthropic-sdk-typescript library released by Anthropic. Versions from 0.79.0 up to, but not including, 0.81.0 are vulnerable. Version 0.81.0 and later contain the fix. The vulnerability is active in server‑side TypeScript or JavaScript applications that use the SDK.

The CVSS score of 6.3 classifies the exploitability as moderate. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a model that can be steered through prompt injection to provide a malicious path, so attackers need access to the model and the ability to craft prompts that result in the malicious path. If such conditions are met, the attacker can read and write arbitrary files within sibling directories, jeopardizing confidentiality and integrity. The overall risk is therefore moderate, with higher priority for environments where model prompts are not strictly controlled.