PT-2026-48540 · Github Actions · Anthropics/Claude-Code-Action

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-47751

OSV

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

Due to the combination of checking out PR head branches (attacker-controlled), reading .mcp.json from the working directory via default setting sources, and unconditionally enabling all project MCP servers via enableAllProjectMcpServers, it was possible for an attacker who opened a PR containing a malicious .mcp.json file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to the workflow (such as API keys and tokens) when a privileged user triggered the Claude action on the PR. Exploiting this required the ability to open a pull request against a repository using the claude-code-action and a privileged user or automatic trigger to invoke the action on that PR.

Users pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags will have received this fix already

Claude Code thanks hackerone.com/reptou for reporting this issue.

Fix

OS Command Injection

Information Disclosure

Weakness Enumeration

CWE-78

CWE-200

Related Identifiers

CVE-2026-47751

GHSA-8Q5R-MMJF-575Q

Affected Products

Anthropics/Claude-Code-Action

References · 3

• https://osv.dev/vulnerability/GHSA-8q5r-mmjf-575q · Vendor Advisory
• https://github.com/anthropics/claude-code-action · Note
• https://github.com/anthropics/claude-code-action/security/advisories/GHSA-8q5r-mmjf-575q · Note