CVE-2026-47751: Vulnerability in anthropics/claude-code-action Allows Remote Code Execution and Secret Exfiltration
Summary
CVE-2026-47751: Due to the combination of checking out PR head branches (attacker-controlled), reading .mcp.json from the working directory via default setting sources, and unconditionally enabling all project MCP servers via enableAllP... Affects anthropics/claude-code-action versions < 1.0.74. Fixed in 1.0.74. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The anthropics/claude-code-action is a GitHub Actions package designed to facilitate the integration of Claude AI into workflows. It allows users to automate tasks and enhance their development processes. However, due to its reliance on external configuration files, it is susceptible to vulnerabilities that can be exploited by malicious actors, particularly when handling pull requests (PRs) from untrusted sources.
Vulnerability Detail
The vulnerability arises from the combination of checking out PR head branches controlled by attackers, reading the '.mcp.json' configuration file from the working directory, and enabling all project MCP servers without restrictions. An attacker can exploit this by submitting a PR with a malicious '.mcp.json' file, leading to arbitrary code execution on the GitHub Actions runner. This can result in the exfiltration of sensitive secrets, such as API keys and tokens, especially if a privileged user triggers the action on the PR.
How To Fix
Minimum fixed version
1.0.74
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid enabling all project MCP servers by setting the configuration to only enable specific servers that are trusted. This can be done by modifying the '.mcp.json' file to include only the necessary server configurations and avoiding the use of 'enableAllProjectMcpServers'.
Conclusion
The CVE-2026-47751 vulnerability in the anthropics/claude-code-action package poses significant risks, including remote code execution and secret exfiltration. Users are strongly advised to update to the patched version 1.0.74 or later to mitigate these risks. Implementing the recommended workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for anthropics/claude-code-action →
FAQ
CVE-2026-47751 is a vulnerability in the anthropics/claude-code-action package that allows remote code execution and secret exfiltration through malicious pull requests.
You can check if your project is affected by using the Vulert platform, which monitors open-source vulnerabilities in your software based on your manifest file, such as package-lock.json.
If you cannot update the package right away, consider implementing the workaround by restricting the MCP server configurations in your '.mcp.json' file.
Failing to address this vulnerability could lead to unauthorized access to sensitive information, including API keys and tokens, and could compromise the security of your application.
More information about CVE-2026-47751 can be found in the advisory published on GitHub and through security monitoring platforms like Vulert.
