Claude Code is an agentic coding tool

CVE-2026-46406 affects Anthropic's @anthropic-ai/claude-code npm package, versions 2.1.59 through 2.1.127, patched in 2.1.128. The /copy slash command writes the model response to a hardcoded path (/tmp/claude/response.md) without per-UID isolation, randomness, or O_NOFOLLOW-style symlink protection. The directory is created 0755 and the file 0644, so any other local user on the same box can (a) read the privileged user's response — which often contains pasted secrets, source, or tokens — or (b) pre-stage a symlink at that path to redirect the write and clobber an attacker-chosen file owned by the victim. CWE-59 (link following) compounded by CWE-377 (insecure temp file) and CWE-200 (info disclosure).

There is no vendor CVSS from Anthropic in NVD, but GitLab's advisory tracker computed 6.1 Medium (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H). That math is fair. This is a local-only, user-interaction-required bug in an interactive developer CLI. It is not a remote code execution, not network-reachable, and the affected install base is developer workstations and CI runners — not domain controllers, hypervisors, or edge appliances. The vendor framing matches reality; we land at MEDIUM, slightly below 6.1 because in practice almost nobody runs Claude Code on a shared multi-user host.

Why this verdict

• Local + UI-required: the chain cannot start without a co-resident unprivileged shell AND the victim choosing to run /copy. That is two compounding gates that exclude >99% of Claude Code installs (single-user laptops, ephemeral CI containers).
• Blast radius capped at one user: worst case is disclosure of one conversation or destructive write to one victim-owned file. No root, no lateral movement, no fleet impact.
• Role multiplier — developer workstation: even in the high-value role enumeration, Claude Code is canonically a *developer endpoint* tool, not a domain controller, hypervisor, IdP, PAM, backup admin, or kernel-mode agent. The component does not occupy any high-value role in the noisgate catalog, so no role-floor applies. Worst credible deployment is a shared bastion or shared CI runner — still bounded to that one host's secrets.
• Modern OS defenses partially mitigate: Linux fs.protected_symlinks=1 (default in essentially every distro since 2012) neutralizes the symlink-write variant when the writer UID ≠ symlink owner UID, leaving only the disclosure variant on those hosts.
• No KEV, no in-the-wild, EPSS expected near-zero: this is a hygiene bug, not an active campaign.

Why not higher?

HIGH would require either network reachability, a privilege escalation to root, or a high-value-role component (IdP, hypervisor, CA, edge appliance). None apply: vector is AV:L, impact is bounded to the invoking user's data and one target file, and the affected component is a dev CLI — not in the noisgate high-value-role catalog. Calling this HIGH would devalue the bucket reserved for actively-exploited remote vulns.

Why not lower?

LOW understates the integrity impact (I:H in the CVSS write — authorized_keys clobber is a plausible outcome on hosts without protected_symlinks) and the realistic disclosure of pasted API keys/PII from chat history. Co-tenant shells do exist on shared bastions, build hosts with multi-tenant runners, and lab boxes. MEDIUM captures the genuine but bounded risk.

1. Upgrade @anthropic-ai/claude-code to 2.1.128 or later fleet-wide — Per noisgate remediation SLA for MEDIUM, you have up to 365 days — but this is a one-line npm i -g @anthropic-ai/claude-code@latest or auto-update flip. Do it this sprint. Inventory via npm ls -g on managed dev endpoints and CI images.
2. Confirm fs.protected_symlinks=1 on every Linux dev host and CI runner — sysctl fs.protected_symlinks should return 1. This is default on modern distros but verify, especially on hardened-minimal containers. Neutralizes the symlink-write variant immediately without waiting on the npm update.
3. On shared multi-user hosts, set /tmp to per-user namespaces — Use systemd-tmpfiles PrivateTmp=yes for services, or pam_namespace.so for interactive shells. Removes the co-tenancy precondition entirely. Apply during the same 365-day remediation window — there is no mitigation SLA at the MEDIUM bucket.
4. Educate developers: don't paste live secrets into Claude Code prompts — The disclosure impact is proportional to what's in the conversation. Reinforce data-handling policy; pair with a secret-scanner pre-commit hook on dev endpoints.

Run on each Linux/macOS dev workstation and CI runner that has Claude Code installed. Invoke as the user that owns the Claude Code install: bash check-cve-2026-46406.sh. No root required; uses npm ls -g and a version comparator. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check-cve-2026-46406.sh — detect @anthropic-ai/claude-code versions vulnerable to CVE-2026-46406
# Vulnerable: 2.1.59 <= version <= 2.1.127
# Fixed:      2.1.128+
set -u

PKG="@anthropic-ai/claude-code"
FIXED="2.1.128"
MIN_VULN="2.1.59"

verlt() { # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  printf '%s\n%s\n' "$1" "$2" | sort -V -C
}

if ! command -v npm >/dev/null 2>&1; then
  echo "UNKNOWN: npm not found"; exit 2
fi

VER=$(npm ls -g --depth=0 --json 2>/dev/null \
      | grep -A1 "\"$PKG\"" | grep version | head -1 \
      | sed -E 's/.*"version": "([^"]+)".*/\1/')

if [ -z "${VER:-}" ]; then
  # try local project install
  VER=$(npm ls --depth=0 --json 2>/dev/null \
        | grep -A1 "\"$PKG\"" | grep version | head -1 \
        | sed -E 's/.*"version": "([^"]+)".*/\1/')
fi

if [ -z "${VER:-}" ]; then
  echo "UNKNOWN: $PKG not installed on this host"; exit 0
fi

if verlt "$VER" "$MIN_VULN"; then
  echo "PATCHED: $PKG $VER (predates vulnerable range)"; exit 0
fi
if verlt "$VER" "$FIXED"; then
  echo "VULNERABLE: $PKG $VER (range 2.1.59-2.1.127, fix in $FIXED)"; exit 1
fi
echo "PATCHED: $PKG $VER (>= $FIXED)"; exit 0

Sources

1. GitLab Advisory — CVE-2026-46406
2. CIRCL Vulnerability Lookup — GHSA-4vp2-6q8c-pvq2
3. Phoenix Security — Three CVEs in Claude Code CLI
4. Zscaler ThreatLabz — Claude Code Leak analysis
5. Check Point Research — Critical Claude Code Flaws
6. CSO Online — Claude Code MCP security problem
7. CWE-59 — Improper Link Resolution Before File Access
8. CWE-377 — Insecure Temporary File