Critical Vulnerability in Claude Code GitHub Action Leads to Repository Hijacking
Executive Summary
In June 2026, a critical vulnerability was discovered in Anthropic's Claude Code GitHub Action, allowing attackers to hijack public repositories by exploiting a flaw in the action's workflow permissions. By opening a malicious GitHub issue, attackers could execute arbitrary code, potentially compromising the integrity of affected repositories and their downstream projects. This vulnerability was promptly addressed by Anthropic with the release of claude-code-action v1.0.94.
This incident underscores the escalating risks associated with supply chain attacks in software development, particularly those leveraging continuous integration and deployment (CI/CD) pipelines. Organizations must remain vigilant, regularly updating their CI/CD tools and scrutinizing third-party actions to mitigate such vulnerabilities.
Why This Matters Now
The increasing reliance on automated CI/CD pipelines amplifies the potential impact of supply chain attacks. This incident highlights the necessity for organizations to implement stringent security measures and regularly audit their development workflows to prevent unauthorized code execution and repository compromise.
Attack Path Analysis
An attacker exploited a flaw in the Claude Code GitHub Action by creating a malicious GitHub App to bypass permission controls, leading to unauthorized code execution and potential repository compromise. This allowed the attacker to escalate privileges by obtaining write access tokens, facilitating further malicious actions. The attacker could then move laterally by injecting malicious code into the repository, affecting downstream projects. Command and control were established through the compromised GitHub Actions workflow, enabling the attacker to execute arbitrary commands. Sensitive data, including environment variables and secrets, were exfiltrated by manipulating the workflow to disclose them. The impact included potential supply chain attacks, compromising the integrity of the codebase and affecting all dependent projects.
Kill Chain Progression
Initial Compromise
Description
An attacker exploited a flaw in the Claude Code GitHub Action by creating a malicious GitHub App to bypass permission controls, leading to unauthorized code execution and potential repository compromise.
Related CVEs
CVE-2026-21852
CVSS 7.5An information disclosure vulnerability in Claude Code allows malicious repositories to exfiltrate API keys before users confirm trust.
Affected Products:
Anthropic Claude Code – < 2.1.75
Exploit Status:
no public exploitCVE-2026-35603
CVSS 7.3A local privilege escalation vulnerability in Claude Code on Windows allows low-privileged users to execute arbitrary code by manipulating configuration files.
Affected Products:
Anthropic Claude Code – < 2.1.75
Exploit Status:
no public exploitCVE-2026-25723
CVSS 6.5A command injection vulnerability in Claude Code allows attackers to bypass file write restrictions and write to sensitive directories.
Affected Products:
Anthropic Claude Code – < 2.0.55
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Poisoned Pipeline Execution
Supply Chain Compromise
Valid Accounts
Modify Authentication Process
Impair Defenses
Command and Scripting Interpreter
Application Layer Protocol
Data Destruction
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change Control Processes
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Data
Control ID: Pillar 3
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
GitHub Action supply-chain attacks directly compromise software development workflows, enabling malicious code injection into repositories and downstream distribution channels.
Information Technology/IT
CI/CD pipeline vulnerabilities expose IT infrastructure to automated malware deployment through compromised GitHub Actions affecting development and deployment processes.
Financial Services
Supply-chain attacks on development tools threaten financial software integrity, potentially compromising trading systems, payment processing, and customer data protection.
Health Care / Life Sciences
Healthcare software repositories using vulnerable GitHub Actions risk HIPAA compliance violations and patient data exposure through compromised development workflows.
Sources
- Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositorieshttps://thehackernews.com/2026/06/claude-code-github-action-flaw-let-one.htmlVerified
- Anthropic Claude Code Action Runner Arbitrary Code Execution via Malicious MCP Server Configuration - Research Advisoryhttps://www.tenable.com/security/research/tra-2026-27Verified
- GHSL-2025-093: Code Injection in PraisonAI claude-code-action GitHub Actions Workflowhttps://securitylab.github.com/advisories/GHSL-2025-093_PraisonAI/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it embeds security directly into the cloud fabric, potentially limiting unauthorized code execution and reducing the attacker's ability to move laterally within the environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute unauthorized code may have been constrained, reducing the likelihood of initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges may have been limited, reducing the scope of potential malicious actions.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally and inject malicious code into other repositories may have been constrained, reducing the impact on downstream projects.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels may have been limited, reducing the effectiveness of remote command execution.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data may have been constrained, reducing the risk of data loss.
The overall impact of the attack may have been reduced, limiting the compromise of the codebase and its downstream effects.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD)
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of API keys and sensitive repository data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and prevent unauthorized lateral movement within repositories.
- • Enhance East-West Traffic Security to monitor and control internal communications, detecting and mitigating unauthorized actions.
- • Utilize Multicloud Visibility & Control to gain comprehensive insights into workflow activities and identify anomalous behaviors.
- • Apply Egress Security & Policy Enforcement to restrict unauthorized data exfiltration and enforce strict outbound traffic policies.
- • Deploy Threat Detection & Anomaly Response mechanisms to promptly identify and respond to suspicious activities within CI/CD pipelines.
