CVE-2026-46406: @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

/copy saved the last response to /tmp/claude/response.md. The path was hardcoded. It had no per-user isolation, no random name and no symlink protection. The file was created with mode 0644 inside a 0755 directory, so any local user could read it.

Two attacks follow. First, a local user can read a privileged user's response, which can hold secrets or credentials that appeared in the session. Second, a local user can create /tmp/claude ahead of time and put a symlink at response.md. When a privileged user runs /copy, Claude Code follows the link and overwrites the target file with the response text.

Both need a local unprivileged account on the same system and a privileged user who runs /copy. That makes it mostly a problem for shared servers, jump hosts, CI runners and multi-user dev boxes, not single-user laptops. The score is medium (CVSS 4.0 of 4.4, local, user interaction required).

@anthropic-ai/claude-code from 2.1.59 up to but not including 2.1.128, on systems where more than one user has a local account. Auto-updating installs already received the fix. Check the version with:

claude --version

For an npm install, npm ls -g @anthropic-ai/claude-code also shows it.

Upgrade to 2.1.128 or later. Auto-update users already have it. For manual installs:

npm install -g @anthropic-ai/claude-code@latest

The advisory lists no workaround. On older versions, avoid /copy on shared machines. Also delete any leftover /tmp/claude/response.md and check that /tmp/claude is owned by the expected user.

Check whether /tmp/claude/response.md exists, who owns it, and whether it is a symlink, using ls -ld /tmp/claude and ls -l /tmp/claude/response.md. A /tmp/claude directory owned by another user, or a symlink at response.md, points to an attempt. Review files modified at the time of a /copy run for unexpected overwrites. On a machine with Beam's agent hooks, its records of agent shell commands and file access can show what a session touched.

The Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Claude Code thanks hackerone.com/c_h4ck_0 for reporting this issue.