Claude Code: one issue could compromise repositories

Colleagues, please note: a vulnerability was found in the GitHub Action 'Claude Code' — a single issue could allow control over public repositories.

- RyotaK demonstrated a bypass: the action trusted actors whose names end with '[bot]'; the example workflow permitted non-write users.
- Via prompt injection attackers read /proc/self/environ and exfiltrated OIDC credentials, obtaining an installation token with write rights.
- Anthropic fixed the bug in four days; patch: claude-code-action v1.0.94 (CVSS 7.8).

Why it matters: actions can be replaced and infect downstream projects.

Recommendation: update to v1.0.94+, verify allowed_non_write_users and trigger permissions, remove public outputs.

Do you have such workflows in your projects?
#cybersecurity #supplychain #GitHubActions #AIsec