EUVD-2026-40116
GHSA-4vp2-6q8c-pvq2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector (AV:L), unprivileged local account sufficient (PR:L), privileged user must run /copy (UI:R), scope change (S:C) as symlink enables writes beyond the process's filesystem permission boundary, high confidentiality and integrity from credential disclosure and arbitrary file overwrite.
Primary rating from Vendor (https://github.com/anthropics/claude-code).
CVSS VectorVendor: https://github.com/anthropics/claude-code
Lifecycle Timeline
3DescriptionCVE.org
The Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/c_h4ck_0 for reporting this issue.
AnalysisAI
Insecure temporary file handling in Claude Code's /copy command exposes privileged users on multi-user systems to two distinct local attacks: passive response disclosure and symlink-based arbitrary file write. The command unconditionally writes AI response content to /tmp/claude/response.md - a static, world-readable path in a world-traversable directory - enabling any local user to read output that may contain secrets, credentials, or sensitive data. A more capable local attacker can pre-plant a symlink at the predictable path, causing a privileged process's /copy invocation to overwrite an attacker-chosen file. Affected versions span @anthropic-ai/claude-code 2.1.59 through 2.1.127; no public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Technical ContextAI
The root cause is CWE-59 (Improper Link Resolution Before File Access, 'Link Following') - a classic insecure temporary file anti-pattern. The /copy command in @anthropic-ai/claude-code writes clipboard-destined AI response content to the static path /tmp/claude/response.md without applying any of the standard POSIX mitigations: no randomized suffix via mktemp, no UID-namespaced subdirectory, no O_CREAT|O_EXCL exclusive creation, no O_NOFOLLOW to reject symlinks, and no restrictive permissions (file created 0644, directory 0755). On Linux and macOS, /tmp is world-traversable by default, meaning any authenticated local user can traverse into /tmp/claude/ and read or replace the target file. The absence of symlink-safe file creation means the kernel will transparently follow any symlink pre-planted at /tmp/claude/response.md, redirecting the write to whatever path the symlink references - potentially outside the writing process's permission boundary. The affected CPE is pkg:npm/@anthropic-ai/claude-code, versions >= 2.1.59 and < 2.1.128.
RemediationAI
The primary fix is upgrading @anthropic-ai/claude-code to version 2.1.128 or later. Users on standard Claude Code auto-update have already received this fix automatically. Users performing manual updates should verify their installed version with claude --version and upgrade via npm install -g @anthropic-ai/claude-code@latest. The vendor advisory is at https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2. Until patching is possible on shared systems, administrators can tighten /tmp/claude/ permissions to mode 0700 owned by the privileged user (chmod 700 /tmp/claude && chown <privileged-user>:root /tmp/claude) to block other local users from reading or planting symlinks - note this must be re-applied on each boot or /tmp cleanup. Completely disabling use of the /copy command eliminates the attack surface with no side effects, as the vulnerability is isolated to that single command path.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today