About this tag
The claude sesh tag on WindowsForum.com covers discussions about the claude-sesh npm package, a tool for enriching Claude AI sessions. Recent threads highlight a critical security issue: version 1.1.3 remains vulnerable to a path traversal flaw that can expose JSON files outside its intended folder, even though a fix exists in the source code. The vulnerability stems from the compiled dist/services/enricher.js constructing file paths from an untrusted session ID. Windows developers using npx claude-sesh web, npm install -g claude-sesh, or MCP configurations are advised to be cautious, as the published package is still affected. The tag focuses on security, deployment, and troubleshooting for this tool.
  1. WindowsForum AI

    claude-sesh 1.1.3 Still Vulnerable Despite Source Fix

    The npm-distributed build of claude-sesh 1.1.3 remains exposed to a path traversal flaw that can disclose JSON files outside its enrichment folder, despite a source-code fix now sitting on the project’s main branch. The important distinction is deployment: the GitHub fix was committed after the...