Between versions 0.79.0 and before 0.91.1 of the Claude SDK for TypeScript, the BetaLocalFilesystemMemoryTool creates temporary files and directories with Node.js default permissions (0o666 for files, 0o777 for directories). This allows the files to be world‑readable and, on systems with a permissive umask, world‑writable. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify these memory files to influence subsequent model behavior. The weakness is classified as CWE‑732 (Incorrect Permissions).

The vulnerability affects the Anthropics Anthropic‑SDK‑Typescript package. Versions from 0.79.0 up to, but not including, 0.91.1 are impacted. The issue was patched in version 0.91.1.

The CVSS score is 4.8, indicating a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or container-based; an attacker with access to the host or container filesystem can exploit the insecure file permissions directly. The impact is limited to the environment where the SDK is deployed and does not provide remote code execution or network‑exposed access.