CVE-2026-34452

CVE-2026-34452 (Claude SDK for Python) affects the async local filesystem memory tool in the Anthropic Python SDK. From versions 0.86.0 up to before 0.87.0, path validation incorrectly allowed union of model-supplied paths to be validated inside the sandbox but the unresolved path to be used for ...

CVE-2026-34450

The Claude SDK for Python (Anthropic) suffers a local-file-permission issue in its local filesystem memory tool: versions 0.86.0 up to before 0.87.0 create memory files with mode 0o666, making them world-readable on typical umasks and world-writable on permissive Docker images. A local attacker o...