Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command. This vulnerability is fixed in 2.1.128.

The version of Anthropic Claude Code installed on the remote host is 2.1.59 prior to 2.1.128. It is, therefore, affected by an information disclosure vulnerability:

  - The Claude Code /copy command wrote responses to a hardcoded,     predictable path (/tmp/claude/response.md) without UID isolation,     randomness, or symlink protection. The file was created     world-readable (0644) in a world-traversable directory (0755),     allowing any local user to read a privileged user's Claude     response, which could contain secrets or credentials.
    Additionally, because the path was static and predictable, a local     attacker could pre-create the directory and plant a symlink at the     expected file path, causing the privileged process to follow the     symlink and overwrite an attacker-chosen file with the response     text. (CVE-2026-46406)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote
    responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or
    symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755),
    allowing any local user to read a privileged user's Claude response, which could contain secrets or
    credentials. Additionally, because the path was static and predictable, a local attacker could pre-create
    the directory and plant a symlink at the expected file path, causing the privileged process to follow the
    symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local
    unprivileged user on the same system and a privileged user to run the /copy command. This vulnerability is
    fixed in 2.1.128. (CVE-2026-46406)

ID	Name	Product	Family	Type	Severity
324950	Anthropic Claude Code 2.1.59 < 2.1.128 Information Disclosure (CVE-2026-46406)	Nessus	Misc.	Local	medium
443937	SCA: security update for @anthropic-ai/claude-code (GHSA-4vp2-6q8c-pvq2)	Tenable Cloud Security	SCA Checks	Local	medium
443937	SCA: security update for @anthropic-ai/claude-code (GHSA-4vp2-6q8c-pvq2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-46406

medium

Tenable Plugins

medium

medium

medium