{
  "entry": {
    "kind": "vuln",
    "slug": "claude-code-github-action-prompt-injection-credential-theft-microsoft",
    "name": "claude-code-github-action-prompt-injection-credential-theft-microsoft",
    "vendor": "Claude Code GitHub Action",
    "description": "Microsoft Security disclosed a now-patched flaw in Anthropic's Claude Code GitHub Action: attackers hide prompt-injection instructions in GitHub issues, pull requests, or comments to manipulate the agent into reading files that hold CI/CD secrets (API keys, cloud credentials) and exfiltrating them. Reported via HackerOne on 2026-04-29 and patched in Claude Code 2.1.128 on 2026-05-05; publicly detailed 2026-06-06.",
    "website": "https://tech.yahoo.com/ai/claude/articles/claude-code-vulnerability-could-let-180856806.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ci",
    "updatedAt": "2026-06-06",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "claude-code-github-action-prompt-injection-credential-theft-microsoft",
      "aliases": [
        "ti-034"
      ],
      "title": "Claude Code GitHub Action: Prompt-Injection Credential Theft (Microsoft Disclosure)",
      "summary": "Microsoft Security disclosed a now-patched flaw in Anthropic's Claude Code GitHub Action: attackers hide prompt-injection instructions in GitHub issues, pull requests, or comments to manipulate the agent into reading files that hold CI/CD secrets (API keys, cloud credentials) and exfiltrating them. Reported via HackerOne on 2026-04-29 and patched in Claude Code 2.1.128 on 2026-05-05; publicly detailed 2026-06-06.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Credential theft"
      ],
      "componentType": "ci",
      "component": {
        "name": "Claude Code GitHub Action",
        "vendor": null,
        "package": null,
        "ecosystem": "github-actions",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<2.1.128",
          "fixed": "2.1.128"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-06-06",
      "modifiedAt": "2026-06-06",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://tech.yahoo.com/ai/claude/articles/claude-code-vulnerability-could-let-180856806.html"
        }
      ],
      "mitigation": "Upgrade Claude Code to 2.1.128 or later. Treat all untrusted GitHub content (issues, PRs, comments) as hostile input; scope CI/CD secrets to least privilege and keep them out of agent-readable files. Review GitHub Action run logs for anomalous file access since late April.",
      "detectedByAnomity": false
    }
  }
}