Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

Summary: A security researcher found a flaw in Anthropic's Claude Code GitHub Action that let an attacker take over vulnerable public repositories by opening a single GitHub issue, because the trigger check waved through any actor whose name ended in [bot]. RyotaK of GMO Flatt Security reported the core bypass to Anthropic in January, Anthropic fixed it within four days with fixes in claude-code-action v1.0.94, rated the issues 7.8 under CVSS v4.0, and paid a bug bounty.
Key Takeaway: The action holds a GitHub App installation token with write access to code, issues, and workflows, so a stolen credential pair replayed against Anthropic's backend hands an attacker the same access - and aimed at the claude-code-action repo itself, it could poison the action downstream projects pull.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026