CVE-2026-46406

Katalog CVE

CVSS 6.1 · Medium EPSS 0,15%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada anthropic claude code. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command. This vulnerability is fixed in 2.1.128.

Rincian

Terbit di NVD

29 Juni 2026

Terakhir diubah

30 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-377: Insecure Temporary File

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 4,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2 advisory vendor