The vulnerability arises from the use of an insecure, hard‑coded temporary file by the /copy command that writes Claude response content to /tmp/claude/response.md. The file is world readable and the directory is world traversable, which allows a local unprivileged user to read data produced by a privileged user, potentially exposing secrets or credentials. Moreover, the predictable file path permits a symlink attack: an attacker can pre‑create a symlink at the expected location so that the privileged process will overwrite an arbitrary file chosen by the attacker with the response text.

The product is Anthropic’s Claude Code. Versions from 2.1.59 up to and including 2.1.127 are affected. The issue is fixed in version 2.1.128.

The CVSS score of 4.4 places the vulnerability in the low‑to‑medium range. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires both a local unprivileged user and a privileged user to execute the /copy command; the file permissions and directory layout allow an attacker to read privileged output or to overwrite another file through a symlink. The risk to an organization depends on the presence of privileged processes and the exposure of /tmp. Updating to the fixed version mitigates the issue and removes the possibility of local disclosure or arbitrary file write.