Executive brief
Claude Code is a terminal-based AI coding assistant used by developers to execute code tasks and obtain AI-generated responses. The /copy command insecurely stores these responses in a predictable world-readable file, allowing any local user to read sensitive content (such as API keys or database credentials) that may be included in those responses. Additionally, attackers can manipulate symlinks to trick the application into overwriting arbitrary files on the system.
Technical details
The vulnerability is a combination of insecure temporary file creation (CWE-377, CWE-200) and symlink following (CWE-59). The Claude Code /copy command writes responses to a hardcoded path `/tmp/claude/response.md` without UID isolation, randomness, or symlink protection. The file is created with world-readable permissions (0644) in a world-traversable directory (0755). A local unprivileged attacker can read responses written by a privileged user process, potentially exposing credentials or secrets. Additionally, an attacker can pre-create the predictable directory structure and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-controlled file with response content. Exploitation requires local system access and a privileged user executing the /copy command. The vulnerability was fixed in version 2.1.128; users on auto-update received the patch automatically.
Affected products
- Anthropic @anthropic-ai/claude-code >=2.1.59, <2.1.128
Timeline
- 2026-06-25: disclosed: Advisory published
- 2026-06-25: patched: Fix released in version 2.1.128