This vulnerability in ErlichLiu claude-agent-sdk-master up to commit b185aa7ff0d864581257008077b4010fca1747bf involves a path traversal issue in the app/api/agent-output/route.ts file. By manipulating the outputFile argument, an attacker can traverse directories and potentially access or overwrite files outside the intended directory. The vulnerability can be exploited remotely without authentication or user interaction. The project was notified early but has not yet responded or released a patch. Due to the rolling release model, no specific patched version is identified.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal, potentially leading to unauthorized file access or modification on the affected system. This could compromise confidentiality or integrity of files accessible by the application. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor the project repository for updates. As a temporary measure, restrict access to the vulnerable API endpoint and validate or sanitize the outputFile parameter to prevent path traversal.