GHSA-4vp2-6q8c-pvq2 CVE-2026-46406
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.15%
- Chance of exploitation in the next 30 days. Higher than 4.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-377 Insecure Temporary File
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
2.1.128- Upgrade @anthropic-ai/claude-code to this version or later
Description
The Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/c_h4ck_0 for reporting this issue.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @anthropic-ai/claude-code | >= 2.1.59, < 2.1.128 |
2.1.128 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@anthropic-ai/claude-code npm → 2.1.128
- npm
npm install @anthropic-ai/claude-code@2.1.128- yarn
yarn add @anthropic-ai/claude-code@2.1.128- pnpm
pnpm add @anthropic-ai/claude-code@2.1.128
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Active
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-377: Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pq7j-f95f-qfcv Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning | High | Also affects @anthropic-ai/claude-code |
| GHSA-7835-87q9-rgvv Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution | High | Also affects @anthropic-ai/claude-code |
| GHSA-fg94-h982-f3mm Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch | Critical | Also affects @anthropic-ai/claude-code |
| GHSA-q5hj-mxqh-vv77 Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution | High | Also affects @anthropic-ai/claude-code |
| GHSA-vp62-r36r-9xqp Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace | Critical | Also affects @anthropic-ai/claude-code |
| GHSA-5cwg-9f6j-9jvx Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows | High | Also affects @anthropic-ai/claude-code |
| GHSA-mmgp-wc2j-qcv7 Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File | High | Also affects @anthropic-ai/claude-code |
| GHSA-ff64-7w26-62rf Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json | Critical | Also affects @anthropic-ai/claude-code |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor