CVE-2026-47751: Claude Code Action Remote Code Execution Vulnerability
MODERATECVE-2026-47751 is a MODERATE remote code execution vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) affecting Claude Code Action libraries in the GitHub Actions ecosystem. The issue involves malicious mcp server configuration in prs enables remote code execution and secret exfiltration. Remediation is available by upgrading affected packages to version 1.0.74.
CVE-2026-47751 at a Glance
How to Fix CVE-2026-47751
To remediate this vulnerability, upgrade all affected Claude Code Action dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade anthropics/claude-code-action to 1.0.74Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for anthropics/claude-code-actionHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-47751, inspect your project dependencies for Claude Code Action:
inspect dependencies for anthropics/claude-code-actionAnalyze the terminal output to locate any version of Claude Code Action in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.74), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), where the product constructs all or part of an os command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended os command when it is sent to a downstream component. In Claude Code Action, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-47751 Affected Claude Code Action Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
anthropics/claude-code-action
|
GitHub Actions |
< 1.0.74
|
1.0.74
|
References
Frequently Asked Questions
What is CVE-2026-47751?
Which Claude Code Action versions are affected?
What version fixes CVE-2026-47751?
Is anthropics/claude-code-action affected?
What CWE is associated with CVE-2026-47751?
How can I check GitHub Actions dependencies for CVE-2026-47751?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-8q5r-mmjf-575q",
"modified" : "2026-09-01T00:59:50Z",
"published" : "2026-06-10T19:33:48Z",
"aliases" : [ "CVE-2026-47751" ],
"summary" : "Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration",
"details" : "Due to the combination of checking out PR head branches (attacker-controlled), reading `.mcp.json` from the working directory via default setting sources, and unconditionally enabling all project MCP servers via `enableAllProjectMcpServers`, it was possible for an attacker who opened a PR containing a malicious `.mcp.json` file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to the workflow (such as API keys and tokens) when a privileged user triggered the Claude action on the PR. Exploiting this required the ability to open a pull request against a repository using the claude-code-action and a privileged user or automatic trigger to invoke the action on that PR.\n\nUsers pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags will have received this fix already\n\nClaude Code thanks hackerone.com/reptou for reporting this issue.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "GitHub Actions",
"name" : "anthropics/claude-code-action"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.0.74"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/anthropics/claude-code-action/security/advisories/GHSA-8q5r-mmjf-575q"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-47751"
}, {
"type" : "WEB",
"url" : "https://github.com/anthropics/claude-code-action/pull/1066"
}, {
"type" : "WEB",
"url" : "https://github.com/anthropics/claude-code-action/commit/9ddce40de8c1ab71fb6303a125fdad0968dc1312"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/anthropics/claude-code-action"
}, {
"type" : "WEB",
"url" : "https://github.com/anthropics/claude-code-action/releases/tag/v1.0.74"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200", "CWE-78" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-10T19:33:48Z",
"nvd_published_at" : "2026-07-16T17:16:57Z"
}
}