Arbitrary Code Execution Vulnerability in Claude Code Action by Anthropic
CVE-2026-47751

5.3MEDIUM

Key Information:

Vendor

Anthropics

Status
Claude-code-action
Vendor
CVE Published:
16 July 2026

What is CVE-2026-47751?

The Claude Code Action, a GitHub action used for executing Claude Code on pull requests and issues, was found to have a significant vulnerability. Earlier than version 1.0.74, the action improperly handled input from attacker-controlled pull request branches. Specifically, it read the .mcp.json file from the working directory without sufficient validation and automatically enabled all project MCP servers. This flaw allowed attackers to embed a malicious .mcp.json file in a pull request, leading to arbitrary code execution on the GitHub Actions runner. Consequently, sensitive information such as API keys and tokens could be exfiltrated when a privileged user invoked this action. The issue is resolved in version 1.0.74, which safeguards against this behavior by restoring .claude/ and .mcp.json from the pull request's base branch prior to execution.

Affected Version(s)

claude-code-action < 1.0.74

References

https://github.com/anthropics/claude-code-action/security...
x_refsource_CONFIRM
https://github.com/anthropics/claude-code-action/pull/1066
x_refsource_MISC
https://github.com/anthropics/claude-code-action/commit/9...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.