---
id: CVE-2026-47751
aliases:
  - GHSA-8q5r-mmjf-575q
title: >-
  Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote
  Code Execution and Secret Exfiltration
summary: >-
  Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote
  Code Execution and Secret Exfiltration
severity: medium
cwe:
  - CWE-78
  - CWE-200
vendor: anthropics
product: anthropics/claude-code-action
ecosystem: actions
affected:
  - anthropics/claude-code-action < 1.0.74
patched:
  - anthropics/claude-code-action 1.0.74
published: '2026-06-10'
updated: '2026-06-10'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8q5r-mmjf-575q'
references:
  - url: >-
      https://github.com/anthropics/claude-code-action/security/advisories/GHSA-8q5r-mmjf-575q
  - url: 'https://github.com/advisories/GHSA-8q5r-mmjf-575q'
tags:
  - ghsa
  - actions
ingestedAt: '2026-07-07T15:41:59.541Z'
epss: 0.00766
epssPercentile: 0.53536
---

## Overview

Due to the combination of checking out PR head branches (attacker-controlled), reading `.mcp.json` from the working directory via default setting sources, and unconditionally enabling all project MCP servers via `enableAllProjectMcpServers`, it was possible for an attacker who opened a PR containing a malicious `.mcp.json` file to achieve arbitrary code execution on the GitHub Actions runner. This could lead to exfiltration of secrets available to the workflow (such as API keys and tokens) when a privileged user triggered the Claude action on the PR. Exploiting this required the ability to open a pull request against a repository using the claude-code-action and a privileged user or automatic trigger to invoke the action on that PR.

Users pinned to a vulnerable version of claude-code-action are advised to update to the latest version. Users referencing anthropics/claude-code-action@v1, anthropics/claude-code-action@beta, anthropics/claude-code-action@main, or other non-pinned tags will have received this fix already

Claude Code thanks hackerone.com/reptou for reporting this issue.

## Affected packages

- `anthropics/claude-code-action < 1.0.74`

## Remediation

Upgrade to a patched release:

- `anthropics/claude-code-action 1.0.74`