CVE-2026-34452 identifies a race condition vulnerability in the async local filesystem memory tool of the Anthropic Python SDK (Claude SDK for Python) versions 0.86.0 to before 0.87.0. This flaw allows a local attacker, with write access to the memory directory, to retarget a symlink between path validation and use, potentially causing reads or writes to escape the sandboxed memory directory. Rated Medium with a CVSS score of 5.8, exploitation requires high attack complexity due to the timing window, but could lead to high confidentiality impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.86.0, < 0.87.0CPE matchmatch criteria | cpe:2.3:a:anthropic:claude_sdk_for_python:*:*:*:*:*:python:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.