CVE-2026-46406: 
MinimOS vulnerability analysis and mitigation

CVE-2026-46406 is an insecure temporary file vulnerability in Anthropic's Claude Code agentic coding tool that enables response disclosure and symlink-based file write attacks. It affects the npm package @anthropic-ai/claude-code versions >= 2.1.59 and < 2.1.128. The vulnerability was discovered by HackerOne researcher c_h4ck_0, disclosed on June 25, 2026, and patched in version 2.1.128. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 4.4 (Medium) (GitHub Advisory, Github Advisory).

The root cause is a combination of CWE-59 (Improper Link Resolution Before File Access / Link Following), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), and CWE-377 (Insecure Temporary File). When a user invokes the /copy command, Claude Code writes the AI response to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness in the filename, or symlink protection. The directory /tmp/claude/ is created world-traversable (permissions 0755) and the file is world-readable (0644), meaning any local user can read its contents. Additionally, because the path is static, a local attacker can pre-create the /tmp/claude/ directory and plant a symlink at /tmp/claude/response.md pointing to an attacker-chosen target file; when a privileged user subsequently runs /copy, the privileged process follows the symlink and overwrites the target file with the Claude response (GitHub Advisory).

Successful exploitation has two distinct impacts: information disclosure and unauthorized file overwrite. A local unprivileged attacker can read the world-readable /tmp/claude/response.md file and obtain sensitive data from a privileged user's Claude session, potentially including API keys, credentials, or other secrets embedded in AI responses. Via the symlink attack vector, the attacker can cause a privileged process to overwrite an arbitrary file on the system with the response content, which could corrupt critical system files or configuration, leading to availability or integrity impacts (GitHub Advisory, Red Hat Bugzilla).

No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.149% (5th percentile), indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. Exploitation requires a local unprivileged account on the same system and relies on a privileged user actively running the /copy command, making opportunistic mass exploitation unlikely (Github Advisory, Red Hat Bugzilla). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Confirm that a target system has Claude Code versions >= 2.1.59 and < 2.1.128 installed and that a privileged user (e.g., root or a high-privilege developer) uses it interactively.
2. Pre-create the target directory: As a local unprivileged attacker, create the directory /tmp/claude/ if it does not already exist: mkdir -p /tmp/claude.
3. Plant a symlink (integrity attack): Create a symlink at the expected file path pointing to an attacker-chosen target file: ln -s /etc/cron.d/malicious_job /tmp/claude/response.md. Alternatively, skip this step to only perform passive disclosure.
4. Wait for privileged user interaction: Wait for the privileged user to run the /copy command within Claude Code, which triggers the tool to write the AI response to /tmp/claude/response.md.
5. Achieve file overwrite (integrity attack): The privileged process follows the symlink and overwrites the attacker-chosen file (e.g., /etc/cron.d/malicious_job) with the Claude response content, potentially enabling further privilege escalation or persistence.
6. Read disclosed response (confidentiality attack): If no symlink was planted, simply read the world-readable file: cat /tmp/claude/response.md to obtain secrets or credentials from the privileged user's Claude session (GitHub Advisory).

• File System: Presence of /tmp/claude/ directory with world-traversable permissions (0755) owned by a user other than the current privileged user; presence of a symlink at /tmp/claude/response.md pointing to an unexpected target file; unexpected modification timestamps on sensitive system files (e.g., cron jobs, sudoers, SSH authorized_keys) coinciding with Claude Code /copy command usage.
• Logs: System audit logs (auditd) showing symlink or open syscalls on /tmp/claude/response.md by a low-privileged UID followed by a write operation by a high-privileged UID; file access logs showing reads of /tmp/claude/response.md by a UID different from the Claude Code process owner.
• Process: Unexpected file write operations by the Claude Code Node.js process (node) to paths outside the user's home directory or project directory, particularly to sensitive system locations via symlink resolution (GitHub Advisory).

Anthropic has released a fix in Claude Code version 2.1.128, which addresses the insecure temporary file handling by adding UID isolation, randomness, and symlink protection to the /copy command's file write logic. Users enrolled in standard Claude Code auto-update will have received this fix automatically. Users performing manual updates should upgrade to version 2.1.128 or later immediately via npm update -g @anthropic-ai/claude-code. As a temporary workaround prior to patching, administrators can restrict access to the /tmp/claude/ directory using sticky-bit enforcement or by configuring filesystem permissions to prevent unprivileged users from creating files or symlinks in /tmp (GitHub Advisory, Github Advisory).

The vulnerability was reported through HackerOne by researcher c_h4ck_0 and acknowledged by Anthropic in the official security advisory. Red Hat tracked the issue via Bugzilla (Bug 2494423) and assigned it medium severity. Security commentary site undercodetesting.com published analysis framing the issue within broader concerns about AI-powered coding agents and their security posture, noting that Claude Code's agentic nature introduces novel attack surfaces (undercodetesting.com). General community reaction has been moderate, consistent with the vulnerability's local-only exploitation requirement.