CVE-2026-41686 Anthropic TypeScript SDK权限不当漏洞

const fs = require('fs'); const path = require('path'); // Simulating the vulnerable behavior of BetaLocalFilesystemMemoryTool const vulnerableDir = './vulnerable_memory'; const vulnerableFile = path.join(vulnerableDir, 'agent_state.json'); // Create directory with 0o777 (vulnerable default) if (!fs.existsSync(vulnerableDir)) { fs.mkdirSync(vulnerableDir, 0o777); console.log(`[+] Created directory with mode: 0o777`); } // Write file with 0o666 (vulnerable default) fs.writeFileSync(vulnerableFile, JSON.stringify({ memory: 'Secret data' }), { mode: 0o666 }); console.log(`[+] Created file with mode: 0o666`); // Check actual permissions const dirStats = fs.statSync(vulnerableDir); const fileStats = fs.statSync(vulnerableFile); // Parse mode (remove file type bits) const dirMode = (dirStats.mode & parseInt('777', 8)).toString(8); const fileMode = (fileStats.mode & parseInt('777', 8)).toString(8); console.log(`[!] Directory actual permissions: ${dirMode}`); console.log(`[!] File actual permissions: ${fileMode}`); // Verify vulnerability if (dirMode === '777' || fileMode === '666') { console.log('[!] VULNERABILITY CONFIRMED: Permissions are too loose.'); } else { console.log('[?] Permissions might be restricted by system umask.'); } // Cleanup fs.unlinkSync(vulnerableFile); fs.rmdirSync(vulnerableDir);