CVE-2026-46406: @anthropic-ai/claude-code Insecure Temporary File Vulnerability Leading to Response Disclosure
Summary
CVE-2026-46406: The Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. Affects @anthropic-ai/claude-code versions >= 2.1.59, < 2.1.128. Fixed in 2.1.128. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @anthropic-ai/claude-code package is a tool designed for AI-assisted coding, enabling developers to leverage advanced AI capabilities in their coding workflows. It facilitates various commands, including the '/copy' command, which is intended to handle responses securely. However, this package has been found to have a significant vulnerability that compromises the security of sensitive information.
Vulnerability Detail
The vulnerability arises from the '/copy' command writing responses to a hardcoded and predictable file path ('/tmp/claude/response.md') without proper UID isolation, randomness, or symlink protection. This file is created with world-readable permissions (0644) in a world-traversable directory (0755), allowing any local user to read the responses of privileged users. Furthermore, the static nature of the file path enables local attackers to create a symlink at the expected location, leading to potential overwriting of files with sensitive data. This vulnerability requires a local unprivileged user to exploit it while a privileged user executes the '/copy' command.
How To Fix
Latest published version: 2.1.308 as of 23 Oct 2026
npm install @anthropic-ai/claude-code@2.1.308Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.128
This is the first release that contains the fix.
npm install @anthropic-ai/claude-code@2.1.128Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the '/tmp/claude' directory or monitor the directory for unauthorized symlink creation until the package is updated.
Conclusion
The CVE-2026-46406 vulnerability in the @anthropic-ai/claude-code package poses a significant risk to sensitive information due to insecure temporary file handling. Users are strongly advised to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for @anthropic-ai/claude-code →
FAQ
CVE-2026-46406 is a vulnerability in the @anthropic-ai/claude-code package that allows local users to read sensitive responses and potentially overwrite files due to insecure temporary file handling.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The consequences include unauthorized access to sensitive information and the potential for local attackers to overwrite files with privileged response data.
Yes, a patch is available in version 2.1.128 of the @anthropic-ai/claude-code package. Users should update to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 4.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @anthropic-ai/claude-code.
