AnthropicGHSA-w828-4qhx-vxx3
Memory Tool Path Validation Race Condition Allows Sandbox Escape
Medium5.8CVE-2026-34452 · Published Mar 31, 2026
The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a symlink between validation and use, causing reads or writes to escape the sandbox. The synchronous memory tool implementation was not affected. Users on the affected versions are advised to update to the latest version. Thank you to hackerone.com/kasthelord for reporting this issue!
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| anthropic PyPI | >= 0.86.0, < 0.87.0 | 0.87.0 |
Details and references
More Anthropic advisories
All Anthropic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 24 | Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution | High7.7 | 2.1.84 |
| Apr 20 | Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace | High7.7 | 2.1.64 |
| Apr 17 | Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows | Medium5.4 | 2.1.75 |
| Mar 31 | Insecure Default File Permissions in Local Filesystem Memory Tool | Medium4.8 | 0.87.0 |
| Mar 31 | Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories | Medium6.3 | 0.81.0 |
| Mar 18 | Workspace Trust Dialog Bypass via Repo-Controlled Settings File | High7.7 | 2.1.53 |