GHSA-8q5r-mmjf-575q: Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

Summary

A flaw in claude-code-action combined checking out attacker-controlled PR head branches, reading `.mcp.json` from the working directory through default setting sources, and unconditionally enabling all project MCP servers via `enableAllProjectMcpServers`. An attacker who opens a PR containing a malicious `.mcp.json` can achieve arbitrary code execution on the GitHub Actions runner. This can expose workflow secrets such as API keys and tokens when a privileged user or automatic trigger runs the action on that PR.

Mitigation

Users pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags have already received the fix.

Topics

• Model Context Protocol

Related items

• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database