Junglewise Threat Intelligence

CVE-2026-47751: Anthropic Claude Code Action arbitrary code execution in GitHub Actions runner

CVE-2026-47751 · Severity: medium · CVSS 5.3 · Published 2026-07-16

Vendors: GitHub Actions, Anthropic.

Executive brief

Anthropic's Claude Code Action is a tool used to automate code reviews and issue management on GitHub. A security flaw allowed attackers to execute malicious code on the GitHub infrastructure by submitting a specially crafted pull request. This could lead to the theft of sensitive credentials, such as API keys and tokens, stored within the GitHub environment.

Technical details

Claude Code Action prior to version 1.0.74 is vulnerable to arbitrary code execution and secret exfiltration. The vulnerability exists because the action checks out the head branch of a pull request (which is attacker-controlled) and subsequently reads configuration files like .mcp.json and .claude/settings.json from the working directory. Because the action unconditionally enabled all project Model Context Protocol (MCP) servers and executed hooks or shell commands defined in these files before tool-permission gating, an attacker could achieve RCE on the GitHub Actions runner. This allows for the exfiltration of workflow secrets. The fix in version 1.0.74 ensures that sensitive configuration files are restored from the trusted base branch before the CLI execution.

Affected products

  • Anthropic claude-code-action < 1.0.74

Timeline

  • 2026-03-17: patched: Fix merged into main branch
  • 2026-03-18: advisory: Version 1.0.74 released
  • 2026-05-20: disclosed: GitHub security advisory published
  • 2026-07-16: advisory: NVD published CVE-2026-47751

References