CVE-2026-22561 is a Windows installer weakness in Anthropic Claude Setup.exe versions prior to 1.1.3363. The issue is an uncontrolled search path element / DLL search-order hijacking problem: after UAC elevation, the installer can load DLLs from its own directory, so a malicious DLL placed alongside the installer may be executed in a privileged context. The vulnerability is rated medium severity in NVD an [truncated]
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU [truncated]
