{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1d532d30-5eb6-5109-9f36-5aec52c68e2e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@anthropic-ai/sdk",
      "purl": "pkg:npm/%40anthropic-ai/sdk@0.131.0",
      "type": "library",
      "bom-ref": "pkg:npm/%40anthropic-ai/sdk@0.131.0",
      "version": "0.131.0",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-34451",
      "affects": [
        {
          "ref": "pkg:npm/%40anthropic-ai/sdk@0.131.0"
        }
      ],
      "bom-ref": "urn:uuid:4552924d-df12-5725-8ba0-59ad90179633",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34451 does not affect version 0.131.0 of @anthropic-ai/sdk. not_affected \u2014 CVE-2026-34451 describes a path traversal vulnerability in the Anthropic TypeScript SDK's local filesystem memory tool where path validation used a string prefix check without appending a trailing path separator. This allowed model-supplied paths to escape the sandbox by resolving to sibling directories sharing the memory root's name as a prefix (e.g., `/memories_backup` passing a check for `/m...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41686",
      "affects": [
        {
          "ref": "pkg:npm/%40anthropic-ai/sdk@0.131.0"
        }
      ],
      "bom-ref": "urn:uuid:2de3b2ce-70c6-5974-8acd-cb84713c1e92",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41686 does not affect version 0.131.0 of @anthropic-ai/sdk. not_affected \u2014 The target repository (@anthropic-ai/sdk v0.131.0) is NOT affected by CVE-2026-41686. The vulnerability described insecure file permissions (0o666 for files, 0o777 for directories) in BetaLocalFilesystemMemoryTool, but the fix was already present in the upstream release before TuxCare onboarded it. The code at lines 17-23 of src/tools/memory/node.ts explicitly sets secure permissions: FILE_CREA...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40anthropic-ai/sdk@0.131.0"
    }
  ]
}