5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47751

CVE-2026-47751: Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47751

CVE-2026-47751:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
anthropics/claude-code-action	actions	< 1.0.74	1.0.74

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the claude-code-action checks out the head of a pull request, which is controlled by the PR author, and then runs the Claude CLI, which reads configuration files like .mcp.json from the current working directory. An attacker could submit a PR with a malicious .mcp.json file that specifies commands to be executed, leading to remote code execution on the GitHub Actions runner.

The analysis of the patch between versions 1.0.73 and 1.0.74 reveals the exact fix. The commit 9ddce40de8c1ab71fb6303a125fdad0968dc1312 introduces a sanitization step.

The primary vulnerable function is run in src/entrypoints/run.ts. This function orchestrates the action's execution. Before the patch, it would directly proceed to install and run the Claude CLI without cleaning the workspace. The patch modifies this run function to call a new function, restoreConfigFromBase, before any configuration is read.

The new restoreConfigFromBase function, located in src/github/operations/restore-config.ts, is the mitigation. It uses git commands to delete a list of sensitive paths (e.g., .mcp.json, .claude/) from the PR's checkout and then restores them with the versions from the trusted base branch. This ensures that any malicious configuration from the attacker is overwritten before the CLI can read it.

Therefore, during exploitation of a vulnerable version, the run function would be on the call stack as it sets up the environment where the malicious configuration is processed by the Claude CLI. The presence of restoreConfigFromBase in a runtime profile would indicate that the patched, non-vulnerable version is being used.

Vulnerable functions

run

src/entrypoints/run.ts

The `run` function in `src/entrypoints/run.ts` is the main orchestrator for the GitHub Action. Before the patch, this function would proceed to execute the Claude CLI (`runClaude`) in the checked-out directory of a pull request. Since the PR's content is attacker-controlled, a malicious `.mcp.json` or other sensitive configuration files could be placed in the repository root. The `run` function lacked the necessary validation to sanitize these files. The vulnerability was that it allowed subsequent functions to process these malicious files, leading to code execution. The patch mitigates this by adding a call to the new `restoreConfigFromBase` function, which overwrites the potentially malicious configuration files with trusted versions from the PR's base branch before they can be processed.

restoreConfigFromBase

src/github/operations/restore-config.ts

This function was added as part of the fix and is not vulnerable itself. It is a security control function that mitigates the vulnerability. It is included here because it is a critical runtime indicator of the patch. It restores sensitive configuration files (`.claude/`, `.mcp.json`, etc.) from the trusted base branch of a pull request, effectively sanitizing the workspace before the Claude CLI is executed. Its presence in a runtime profile indicates that the patched version of the action is in use.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.