Claude Code GitHub Action Flaw Could Let Malicious Issues Hijack Repositories
Summary
A researcher showed how a flawed trigger check and indirect prompt injection could expose workflow secrets and enable repository write access. Anthropic fixed the issue in v1.0.94; the exact path was tested in the researcher’s repos, with no public evidence of live use.
Key points
- The action accepted actors whose names ended in [bot], allowing an attacker-controlled GitHub App to submit issue content to vulnerable workflows.
- In test repositories, indirect prompt injection could make Claude expose environment secrets in an issue.
- The article explains that stolen workflow credentials could be used to obtain a GitHub App installation token with repository write access.
- Anthropic fixed the issue in claude-code-action v1.0.94 after RyotaK reported it; Anthropic rated the issues 7.8 under CVSS v4.0.
- Anthropic also warned against allowing untrusted users to trigger workflows and recommended limiting secrets, tools, and permissions.
- The article reports no public evidence that this exact path was used against a live target; a separate prompt-injection incident involving Cline led to an unauthorized [email protected] release.
Article Details
- Vulnerability Types
- Authorization bypass in the bot trigger check
- Indirect prompt injection
- Exposure of workflow credentials and secrets
- Severity
- CVSS v4.0: 7.8
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Audit workflows that allow users without write access or bots to trigger Claude.
- For workflows processing untrusted input, provide no secrets beyond the Anthropic API key and GITHUB_TOKEN.
- Remove tools and permissions that could be used for exfiltration.
MITRE ATT&CK
T1059.004 · Unix ShellThe injected issue content induced Claude to run commands that accessed /proc/self/environ.T1195.002 · Compromise Software Supply ChainIn a related Cline incident, attackers reportedly used the workflow attack chain to steal an npm publish token and publish an unauthorized [email protected].T1550.001 · Application Access TokenThe article says stolen GitHub Actions credentials could be replayed to exchange for a GitHub App installation token with write access.T1552 · Unsecured CredentialsThe attack read secrets from the workflow process environment through /proc/self/environ.T1567 · Exfiltration Over Web ServiceSecrets were written into a GitHub issue or workflow summary, making them accessible to the attacker.T1659 · Content InjectionAn attacker placed instructions in a GitHub issue so Claude would follow them instead of its intended task.
People
Vendors
AnthropicA security researcher found a flaw in Anthropic’s Claude Code GitHub Action that could let an attacker take over vulnerable public repositories with a single opened GitHub issue, and even potentially poison Anthropic’sGitHubA security researcher found a flaw in Anthropic’s Claude Code GitHub Action that could let an attacker take over vulnerable public repositories with a single opened GitHub issue, and even potentially poison Anthropic’s
Products
Claude Code GitHub ActionA security researcher found a flaw in Anthropic’s Claude Code GitHub Action that could let an attacker take over vulnerable public repositories with a single opened GitHub issue, and even potentially poison Anthropic’sCline#ClaudeCodeGitHubActionGitHub ActionsClaude Code GitHub Actions drops Claude into CI/CD pipelines to triage issues, slap on labels, review pull requests, or run slash commands.