{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1a78a0d1-a673-5ae0-a50d-b1260b79b146",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@anthropic-ai/sdk",
      "purl": "pkg:npm/%40anthropic-ai/sdk@0.126.0",
      "type": "library",
      "bom-ref": "pkg:npm/%40anthropic-ai/sdk@0.126.0",
      "version": "0.126.0",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-34451",
      "affects": [
        {
          "ref": "pkg:npm/%40anthropic-ai/sdk@0.126.0"
        }
      ],
      "bom-ref": "urn:uuid:ec5df57f-c53c-52cb-830a-43713ca14f04",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34451 does not affect version 0.126.0 of @anthropic-ai/sdk. not_affected \u2014 The target (@anthropic-ai/sdk v0.126.0) is NOT AFFECTED. The path traversal vulnerability via sibling directory exploitation has been fixed by upstream. The fix (appending path.sep to prefix validation checks) is present at both validation points (lines 84 and 152 in src/tools/memory/node.ts). All filesystem operations in the memory tool are properly gated by the secure validatePath function. T...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41686",
      "affects": [
        {
          "ref": "pkg:npm/%40anthropic-ai/sdk@0.126.0"
        }
      ],
      "bom-ref": "urn:uuid:253f537e-dbcf-5e86-ac2e-84cc370c148c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41686 does not affect version 0.126.0 of @anthropic-ai/sdk. not_affected \u2014 CVE-2026-41686 describes insecure file permissions in BetaLocalFilesystemMemoryTool (files created with 0o666, directories with 0o777, leaving them world-readable/writable in permissive umask environments). The target repository version 0.126.0 at SHA 973439433e5f9d3374bc6d2377afb744a65ca0b2 already contains the upstream fix. The code explicitly sets FILE_CREATE_MODE=0o600 and DIR_CREATE_MODE=0...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40anthropic-ai/sdk@0.126.0"
    }
  ]
}