Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47751— Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

Quick assessment

Affected
anthropics claude-code-action
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Anthropic Claude Code Action是美国Anthropic公司的一款集成AI代码辅助功能的自动化工具。 Anthropic Claude Code Action 1.0.74之前版本存在安全漏洞，该漏洞源于检出攻击者控制的拉取请求头部分支、默认从工作目录读取 .mcp.json 以及无条件启用所有项目 MCP 服务器，可能导致打开含有恶意 .mcp.json 文件的拉取请求时在 GitHub Actions 运行器上执行任意代码并泄露工作流中的机密信息（如 API 密钥和令牌）。

AI Predicted 9.8 Difficulty: Easy EPSS 0.77% · P55

Affected Version Matrix 1

VendorProduct Version RangeStatus
anthropics claude-code-action < 1.0.74 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47751

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Source: CVE Program / CVE List V5
Vulnerability Description
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Anthropic Claude Code Action 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Anthropic Claude Code Action是美国Anthropic公司的一款集成AI代码辅助功能的自动化工具。 Anthropic Claude Code Action 1.0.74之前版本存在安全漏洞，该漏洞源于检出攻击者控制的拉取请求头部分支、默认从工作目录读取 .mcp.json 以及无条件启用所有项目 MCP 服务器，可能导致打开含有恶意 .mcp.json 文件的拉取请求时在 GitHub Actions 运行器上执行任意代码并泄露工作流中的机密信息（如 API 密钥和令牌）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
anthropics claude-code-action < 1.0.74 -

II. Public POCs for CVE-2026-47751

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47751

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-47751 (2)

Vendor Advisories for CVE-2026-47751 (1)

Same Patch Batch · anthropics · 2026-07-16 · 3 CVEs total

CVE-2026-55406 Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
CVE-2026-55407 Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocatio

IV. Related Vulnerabilities

Same vendor: anthropics
Same weakness: CWE-78

V. Comments for CVE-2026-47751

No comments yet

Leave a comment