{"action":"Upgrade @anthropic-ai/claude-code to 2.1.128 or later.","affected":[{"fixed":"2.1.128","introduced":"2.1.59"}],"component":"@anthropic-ai/claude-code","cve_ids":["CVE-2026-46406"],"ecosystem":"npm","epss":0.00154,"exploited":false,"fixed_versions":["2.1.128"],"ghsa_id":"GHSA-4vp2-6q8c-pvq2","id":"tcs_01M5KF1JHASQRJTMDCN0RDHG3H","modified_at":"2026-07-09T05:15:08.591063132Z","published_at":"2026-06-25T16:53:00Z","references":["https://osv.dev/vulnerability/GHSA-4vp2-6q8c-pvq2","https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2","https://github.com/anthropics/claude-code"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-4vp2-6q8c-pvq2","url":"https://osv.dev/vulnerability/GHSA-4vp2-6q8c-pvq2"}],"summary":"@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write"}