ghsa-8q5r-mmjf-575q

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8q5r-mmjf-575q/GHSA-8q5r-mmjf-575q.json"
      },
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "anthropics/claude-code-action"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.74"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47751"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-10T19:33:48Z",
    "nvd_published_at": "2026-07-16T17:16:57Z",
    "severity": "MODERATE"
  },
  "details": "Due to the combination of checking out PR head branches (attacker-controlled), reading `.mcp.json` from the working directory via default setting sources, and unconditionally enabling all project MCP servers via `enableAllProjectMcpServers`, it was possible for an attacker who opened a PR containing a malicious `.mcp.json` file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to the workflow (such as API keys and tokens) when a privileged user triggered the Claude action on the PR. Exploiting this required the ability to open a pull request against a repository using the claude-code-action and a privileged user or automatic trigger to invoke the action on that PR.\n\nUsers pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags will have received this fix already\n\nClaude Code thanks hackerone.com/reptou for reporting this issue.",
  "id": "GHSA-8q5r-mmjf-575q",
  "modified": "2026-09-15T05:30:04.987810812Z",
  "published": "2026-06-10T19:33:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/anthropics/claude-code-action/security/advisories/GHSA-8q5r-mmjf-575q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47751"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anthropics/claude-code-action/pull/1066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anthropics/claude-code-action/commit/9ddce40de8c1ab71fb6303a125fdad0968dc1312"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/anthropics/claude-code-action"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anthropics/claude-code-action/releases/tag/v1.0.74"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration"
}