CVE-2026-47751

score

<0.1

cvss

—

epss

0.8%

published

2026-07-16

kev added

—

first seen

2026-10-21

Claude Code Action < 1.0.74 contains a remote code execution caused by unchecked .mcp.json file from attacker-controlled pull request branches, letting attackers execute arbitrary code and exfiltrate secrets on GitHub Actions runner, exploit requires privileged user or automatic trigger invoking the action.