Skip to content
OpenAdvisories

Vendor

Anthropic

6 known vulnerabilities.

Products

@anthropic-ai/claude-code 2 Claude Desktop Cowork 1 MCP TypeScript SDK 1 Claude Desktop - Windows 1 Slack MCP Server 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-103435

    Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

    Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker w…

    Anthropic @anthropic-ai/claude-code
  • High 8.7
    CVE-2026-7574 Public exploit

    Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use

    Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image conte…

    Anthropic Claude Desktop Cowork
  • High 8.7
    CVE-2026-0621

    MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

    Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression use…

    Anthropic MCP TypeScript SDK langfuse-3-worker langfuse-3 Wolfi npm