CVE-2026-46406: Anthropic Claude Code insecure temporary file in copy command

CVE-2026-46406 · Severity: medium · CVSS 4 · Published 2026-06-29

Claude Code is a terminal-based AI coding assistant used by developers to execute code tasks and obtain AI-generated responses. The /copy command insecurely stores these responses in a predictable world-readable file, allowing any local user to read sensitive content (such as API keys or database credentials) that may be included in those responses. Additionally, attackers can manipulate symlinks to trick the application into overwriting arbitrary files on the system.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-46406 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46406 being exploited in the wild.
How severe is CVE-2026-46406?
Medium severity, with a CVSS score of 4, published 29 June 2026.
Which products and versions are affected?
Anthropic Claude Code >= 2.1.59, < 2.1.128; @anthropic-ai/claude-code (npm) >= 2.1.59, < 2.1.128, SEMVER:introduced=2.1.59,fixed=2.1.128.
Is there a fix for CVE-2026-46406?
Yes. @anthropic-ai/claude-code (npm): upgrade to 2.1.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46406 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-46406?
Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @anthropic-ai/claude-code (npm): upgrade to 2.1.128 or later
    npm install @anthropic-ai/claude-code@2.1.128

Technical details

The vulnerability is a combination of insecure temporary file creation (CWE-377, CWE-200) and symlink following (CWE-59). The Claude Code /copy command writes responses to a hardcoded path `/tmp/claude/response.md` without UID isolation, randomness, or symlink protection. The file is created with world-readable permissions (0644) in a world-traversable directory (0755). A local unprivileged attacker can read responses written by a privileged user process, potentially exposing credentials or secrets. Additionally, an attacker can pre-create the predictable directory structure and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-controlled file with response content. Exploitation requires local system access and a privileged user executing the /copy command. The vulnerability was fixed in version 2.1.128; users on auto-update received the patch automatically.

Affected products

  • Anthropic @anthropic-ai/claude-code >=2.1.59, <2.1.128

Identifiers

  • CVE-2026-46406
  • GHSA-4vp2-6q8c-pvq2

Timeline

  • 2026-06-25: disclosed: Advisory published
  • 2026-06-25: patched: Fix released in version 2.1.128

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.