Anthropic claude-code up to 2.1.127 /tmp/claude/response.md link following

Summaryinfo

A vulnerability, which was classified as critical, was found in Anthropic claude-code up to 2.1.127. Affected by this issue is some unknown functionality of the file /tmp/claude/response.md. The manipulation results in link following. This vulnerability was named CVE-2026-46406. The attack needs to be approached locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Anthropic claude-code up to 2.1.127. Affected is some unknown functionality of the file /tmp/claude/response.md. The manipulation with an unknown input leads to a link following vulnerability. CWE is classifying the issue as CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command. This vulnerability is fixed in 2.1.128.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-46406 since 05/13/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 2.1.128 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Anthropic

Name

• claude-code

Version

• 2.1.127

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion