Description
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.
Published: 2026-07-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Claude Code Action is a general-purpose GitHub action that runs Claude Code on pull requests and issues. Prior to version 1.0.74, because the action checked out attacker-controlled pull-request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opens a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invokes the action on the pull request. This problem was fixed by restoring .claude/ and .mcp.json from the pull-request base branch before execution.

Affected Systems

The affected product is Claude Code Action produced by Anthropic. Versions prior to 1.0.74 are vulnerable. The vulnerability is present only when the action is used in repositories that permit pull requests with unchecked head branches.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a malicious pull request opened by an attacker. An attacker who can open a pull request—such as a contributor with write access—or can trick a privileged user into accepting the pull request will be able to execute arbitrary code and exfiltrate secrets during the action run.

Generated by OpenCVE AI on July 31, 2026 at 01:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official update to version 1.0.74 or later which restores pull‑request base files before execution.
  • Restrict pull‑request reviews so that only trusted users can merge code that the action will execute.
  • Disable the enableAllProjectMcpServers option or limit the action’s runtime privileges via IAM or workflow permissions.

Generated by OpenCVE AI on July 31, 2026 at 01:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8q5r-mmjf-575q Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Anthropics
Anthropics claude-code-action
Vendors & Products Anthropics
Anthropics claude-code-action

Sat, 18 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.
Title Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Weaknesses CWE-200
CWE-78
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Anthropics Claude-code-action
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-18T02:55:59.645Z

Reserved: 2026-05-19T22:16:39.505Z

Link: CVE-2026-47751

cve-icon Vulnrichment

Updated: 2026-07-18T02:55:55.586Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T02:00:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')