CVE-2026-34450 Anthropic Python SDK 文件权限不当漏洞

import os import tempfile # Simulating the vulnerable file creation logic in the SDK # The SDK creates memory files with mode 0o666 def create_vulnerable_memory_file(filename): # Create a file with mode 0o666 (rw-rw-rw-) fd = os.open(filename, os.O_RDWR | os.O_CREAT, 0o666) with os.fdopen(fd, 'w') as f: f.write('{"memory": "sensitive_agent_state"}') return filename # Setup a temporary directory for testing temp_dir = tempfile.mkdtemp() memory_file = os.path.join(temp_dir, "agent_memory.json") print(f"Creating file: {memory_file}") create_vulnerable_memory_file(memory_file) # Check the file permissions file_stat = os.stat(memory_file) octal_permissions = oct(file_stat.st_mode & 0o777) print(f"File permissions: {octal_permissions}") if octal_permissions == '0o666': print("[!] VULNERABLE: File is world-readable and world-writable.") print(" An attacker could read sensitive data or modify the agent's memory.") else: print("[+] SAFE: File permissions are restricted.") # Cleanup os.remove(memory_file) os.rmdir(temp_dir)