4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41686

CVE-2026-41686: Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memory files and directories using the Node.js default modes (0o666 for files, 0o777 for directories), leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify memory files to influence subsequent model behavior. This issue has been patched in version 0.91.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41686

CVE-2026-41686:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@anthropic-ai/sdk	npm	>= 0.79.0, < 0.91.1	0.91.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the BetaLocalFilesystemMemoryTool class, which failed to specify secure file permissions when creating files and directories. The tool relied on Node.js's default modes, which are 0o777 for directories and typically 0o666 for files. In environments with a permissive umask (e.g., 0o000, common in Docker containers), this resulted in world-readable and world-writable memory files and directories.

A local attacker could exploit this to either read sensitive agent state from the memory files or modify them to manipulate the agent's behavior. The vulnerability affected any function within the class that performed a file system write operation, including directory creation and file creation/modification.

The patch addresses this by explicitly setting secure modes (0o700 for directories and 0o600 for files) in all fs.mkdir and fs.open calls, restricting access to only the owner of the process. The identified vulnerable functions are the public methods in the BetaLocalFilesystemMemoryTool class that trigger these insecure file system operations.

Vulnerable functions

BetaLocalFilesystemMemoryTool.init

src/tools/memory/node.ts

This static method initializes the memory tool's root directory. In the vulnerable version, it created this directory using Node.js's default `fs.mkdir` mode (0o777), making it world-writable and readable in environments with a permissive umask.

BetaLocalFilesystemMemoryTool.create

src/tools/memory/node.ts

This method creates a new file in the memory store. It was vulnerable in two ways: it created necessary parent directories with insecure permissions (0o777), and it created the file itself with insecure default permissions (often 0o666).

BetaLocalFilesystemMemoryTool.rename

src/tools/memory/node.ts

This method renames a file. When the new path was in a non-existent directory, the method would create that directory using the default insecure `fs.mkdir` mode (0o777), making the new directory world-writable.

BetaLocalFilesystemMemoryTool.str_replace

src/tools/memory/node.ts

This method performs a string replacement in a file by writing to a temporary file first (via `atomicWriteFile`). In the vulnerable version, this temporary file was created with insecure default permissions, exposing its content to local attackers.

BetaLocalFilesystemMemoryTool.insert

src/tools/memory/node.ts

This method inserts text into a file by writing to a temporary file first (via `atomicWriteFile`). In the vulnerable version, this temporary file was created with insecure default permissions, exposing its content to local attackers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.