CVE-2026-46406: Claude Code /copy Command Local Information Disclosure and Symlink Exploitation

Technical summary

The vulnerability stems from three compounding weaknesses in path handling. First, the /copy command used a static, world-readable path (/tmp/claude/response.md) without per-user isolation or random components. Second, the file was created with 0644 permissions in a 0755 directory, making it readable to any local user. Third, no symlink protection or O_EXCL flag was used during file creation, allowing an attacker to pre-populate the directory with a symlink pointing to a target file, causing the privileged process to follow that symlink and overwrite the attacker's chosen destination. The vulnerability affects CWE-200 (exposure of sensitive information), CWE-377 (insecure temporary file), and CWE-59 (symlink following). Exploitation requires both local access and a privileged user performing the /copy operation on the same system.

Business impact

The primary business risk is credential or secret exposure. Claude Code users may include API keys, authentication tokens, or other sensitive data in their /copy requests; if a lower-privileged user or attacker reads the response file, those secrets are compromised. The secondary risk is file corruption or privilege escalation through symlink manipulation—an attacker could overwrite system or application files if the privileged process has sufficient permissions. In environments where Claude Code runs as a service account or root, this could lead to system unavailability or unauthorized modification of critical files. The impact is most acute in shared systems, containerized deployments where user isolation is weak, or high-security environments handling sensitive intellectual property or credentials.

Affected systems

Claude Code versions 2.1.59 through 2.1.128 are affected. Version 2.1.128 and later include the fix. Organizations should inventory deployments of Claude Code in this version range, particularly in multi-user systems, CI/CD pipelines, or shared container environments where local privilege boundaries matter. The vulnerability is local-only, so remote exposure is not possible; however, any system allowing multiple local user accounts or running untrusted code poses risk.

Exploitability

Exploitability is moderate. An attacker must have local system access and unprivileged user credentials—they cannot trigger the vulnerability remotely. The attack surface narrows further because the /copy command must be invoked by a privileged user (such as a service account or administrator) at roughly the same time the attacker is monitoring or manipulating /tmp/claude/. No user interaction is required beyond the privileged user running /copy; the attacker's symlink or file read happens automatically. In practice, this favors scenarios with predictable execution patterns (e.g., scheduled tasks, automated CI/CD jobs, or long-running services) where timing is easier to predict.

Remediation

Upgrade Claude Code to version 2.1.128 or later immediately. This version addresses all three root causes: using per-user temporary directories with randomized paths, applying restrictive file permissions (0600), and implementing symlink-safe file creation (typically via mkstemp or equivalent secure temporary file APIs). For organizations unable to upgrade immediately, operational mitigations include restricting /tmp permissions, using AppArmor or SELinux to limit symlink following in /tmp, and limiting local user accounts on systems running Claude Code. However, these are defensive; patching is the correct long-term fix.

Patch guidance

Upgrade to Claude Code 2.1.128 or later. Verify the version in your deployment using the tool's version command or package manager. If using Docker or containerized Claude Code, rebuild images from the updated base or directly update the package. Test the upgrade in a non-production environment first to ensure compatibility with your workflows. No special migration steps or configuration changes are required; the fix is transparent to end users.

Detection guidance

Monitor for suspicious symlink activity in /tmp/claude/ directory. Use tools like auditd (on Linux) to log symlink creation and file access patterns in /tmp/claude/. Check file permissions on /tmp/claude/response.md after it is created; permissions should not be 0644 on patched versions. Scan process execution logs for the /copy command and cross-reference with local user login activity to detect timing patterns suggesting exploitation. Review /tmp for unexpected symlinks pointing to sensitive files (e.g., /etc/passwd, application config files). On systems with SELinux or AppArmor, ensure policies restrict symlink following in /tmp.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS 3.1 score of 6.1 (MEDIUM) reflects the local-only attack vector and requirement for privileged user cooperation, but the integrity and confidentiality impacts (file read/write to arbitrary locations) and availability component (potential file corruption) justify swift remediation. Organizations should prioritize systems where Claude Code runs as a service account or with elevated privileges, or where /tmp isolation is weak. For standard development workstations or single-user systems, risk is lower but still non-zero.

Risk score, explained

CVSS 3.1 score 6.1 (MEDIUM) reflects: Attack Vector (Local) — requires local system access, reducing overall risk; Attack Complexity (Low) — no unusual conditions needed once access is gained; Privileges Required (Low) — unprivileged users can exploit it; User Interaction (Required) — depends on a privileged user running /copy, limiting autonomous exploitation; Scope (Unchanged) — impact confined to the local system; Confidentiality (Low) — secrets in response files are exposed, but impact is narrow to that single interaction; Integrity (Low) — symlink overwrite risk exists but is constrained by file permissions; Availability (High) — arbitrary file overwrite could disable services. The MEDIUM severity is appropriate for a local, context-dependent vulnerability with real but bounded impact.

Frequently asked questions