Security context

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

src/anthropic/lib/tools/_beta_builtin_memory_tool.py: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Path Traversal: The filesystem-based memory tool was vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) path traversal vulnerability via symbolic link swapping. Attackers could exploit this to bypass path canonicalization checks using unresolved symlink paths.

Insecure Permissions: Intermediate directories created during filesystem memory operations did not restrict permissions securely, relying instead on the process umask. This could allow local attackers to conduct symlink-swap attacks on Unix-like environments if directories are created with overly permissive modes.

Path Traversal: Client request path template interpolation allowed unsafe dot-segments and percent-encoded dot-segments to pass through, enabling potential path traversal against API endpoints.