The nnU-Net issue triage workflow contains an agentic workflow injection flaw. It directly inserts the untrusted issue title and body into the prompt for an anthropic/claude-code-action agent. Because the workflow grants the agent command‑capable access to comment and relabel the issue, an attacker can craft a GitHub issue that steers the agent beyond its intended triage purpose and execute arbitrary actions on the repository. This lack of input validation and the unlimited command scope can lead to unauthorized modifications of issue metadata, comments, or labels issued under the account that triggered the workflow.

The vulnerability affects the MIC‑DKFZ nnUNet project. Any repository using the default .github/workflows/issue-triage.yml workflow prior to version 2.4.1 is susceptible. Users who have not upgraded to 2.4.1 or later are at risk.

The CVSS score of 7.2 classifies the flaw as a high‑severity vulnerability. EPSS data is unavailable, so exact exploitation probability cannot be quantified, but the flaw is listed as not present in KEV. The likely attack vector is through the automatic issue.opened trigger, requiring an authenticated GitHub user with permission to create issues. An attacker can submit a crafted issue and manipulate the workflow to perform unauthorized actions, potentially impacting the integrity and visibility of issue tracking on projects that rely on nnUNet.