{"data":{"id":"62b64956-a26d-4070-aca1-7761af080367","title":"GHSA-8q5r-mmjf-575q: Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration","summary":"A flaw in claude-code-action combined checking out attacker-controlled PR head branches, reading `.mcp.json` from the working directory through default setting sources, and unconditionally enabling all project MCP servers via `enableAllProjectMcpServers`. An attacker who opens a PR containing a malicious `.mcp.json` can achieve arbitrary code execution on the GitHub Actions runner. This can expose workflow secrets such as API keys and tokens when a privileged user or automatic trigger runs the action on that PR.","solution":"Users pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags have already received the fix.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-8q5r-mmjf-575q","publishedAt":"2026-06-10T19:33:48.000Z","cveId":"CVE-2026-47751","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain","prompt_injection"],"issueType":"vulnerability","affectedPackages":["anthropics/claude-code-action@< 1.0.74 (fixed: 1.0.74)"],"affectedPackageNames":["anthropics/claude-code-action"],"affectedPackageRefs":["actions:anthropics/claude-code-action"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code Action","Claude Code","claude-code-action"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00766,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-8q5r-mmjf-575q"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-10T19:33:48.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:34:43.667Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0051"],"fixes":[{"ecosystem":null,"name":"anthropics/claude-code-action","fixedVersion":"1.0.74","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:34:43.521Z"}]}}