CVE-2026-34451: Claude SDK TypeScript 路径遍历漏洞

// Conceptual PoC demonstrating the bypass logic const MEMORY_ROOT = '/var/sandbox/memory'; // Vulnerable validation logic (simplified) function isPathValid(path) { // Vulnerability: Checks prefix without ensuring trailing separator return path.startsWith(MEMORY_ROOT); } // Exploit scenario: Attacker injects prompt to access sibling directory const maliciousPath = '/var/sandbox/memorystore'; // Note: starts with MEMORY_ROOT prefix if (isPathValid(maliciousPath)) { console.log(`[+] Access granted to: ${maliciousPath}`); // In the real scenario, the SDK would read/write here } else { console.log('[-] Access denied'); }