Claude Code Action is a GitHub action that runs Claude Code on pull requests and issues. Versions before 1.0.74 improperly checked out attacker-controlled pull request head branches and read .mcp.json files from the working directory without validation, enabling all project MCP servers unconditionally. This allowed attackers to craft malicious .mcp.json files in pull requests to achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets such as API keys and tokens when the action was triggered by privileged users or automatic workflows. The vulnerability is addressed in version 1.0.74 by restoring the .claude/ directory and .mcp.json files from the pull request base branch prior to running the CLI, preventing execution of attacker-controlled files.

An attacker who can open a pull request can execute arbitrary code on the GitHub Actions runner environment and potentially exfiltrate sensitive secrets available to the workflow, including API keys and tokens. This can lead to unauthorized access and compromise of the CI/CD environment and associated resources. The vulnerability requires the action to be invoked by a privileged user or an automatic trigger with sufficient permissions.

Upgrade to version 1.0.74 or later, which fixes the vulnerability by restoring .claude/ and .mcp.json files from the pull request base branch before running the CLI. No other mitigation or temporary fix is documented. Patch status is not explicitly confirmed as 'official-fix' in the advisory, but the version 1.0.74 update addresses the issue.