{"data":{"id":"61234743-ce42-4f93-b6af-cc58f45caec8","title":"CVE-2026-7235: A security vulnerability has been detected in ErlichLiu claude-agent-sdk-master up to…","summary":"CVE-2026-7235 affects ErlichLiu claude-agent-sdk-master up to commit b185aa7ff0d864581257008077b4010fca1747bf. Manipulating the outputFile argument in app/api/agent-output/route.ts leads to path traversal, and the attack may be initiated remotely. The exploit has been publicly disclosed and may be used, and the project was informed through an issue report but has not responded.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7235","publishedAt":"2026-04-28T08:16:02.467Z","cveId":"CVE-2026-7235","cweIds":["CWE-22"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["claude-agent-sdk"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ErlichLiu claude-agent-sdk-master path traversal via outputFile argument","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0046,"epssCheckedAt":"2026-11-09T18:09:51.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-47r4-p7wr-42hw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T12:11:04.112Z","patchAvailable":null,"disclosureDate":"2026-04-28T08:16:02.467Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}