Loading story…
PraisonAI fixed a critical command injection flaw, tracked as CVE-2026-48168, in its bundled Claude GitHub Actions workflow before version 4.6.40. The vulnerability allowed an external contributor to open a pull request from a fork with a malicious branch name and then trigger the workflow with an @claude comment, causing attacker-controlled shell commands to run on the GitHub Actions runner. The issue received a CVSS 3.1 score of 10.0.
The exposed workflow reportedly ran with a GitHub App token that had write permissions, along with OIDC access and gh/git capabilities, creating a path from initial command execution to repository compromise, pull request or issue manipulation, and token abuse. A PraisonAI hardening commit shows the project remediated the branch-handling weakness by adding safer quoting and broader input validation, alongside other security controls such as SSRF protections, sandbox escape prevention, RBAC tightening, path containment, and stricter authentication safeguards.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for a critical command injection flaw in PraisonAI’s bundled Claude GitHub Actions workflow was published, describing how an external contributor could use a malicious pull request branch name and an @claude comment to achieve arbitrary shell execution on the runner. The advisory states the issue affects versions before 4.6.40, carries a CVSS 10.0 rating, and notes it was fixed in version 4.6.40.
A PraisonAI security hardening commit introduced multiple protections across the project, including quoting GitHub Actions branch names to prevent command injection in the bundled Claude workflow. The same commit also added SSRF, sandbox, RBAC, IDOR, path containment, authentication, and JWT safeguards with accompanying tests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple security flaws in Anthropic’s **Claude Code GitHub Action** that could let attackers compromise public repositories and expose CI/CD secrets through a single malicious GitHub issue or other untrusted content. One issue, reported by RyotaK of GMO Flatt Security, stemmed from an authorization bypass that trusted any GitHub actor whose name ended in `[bot]`, allowing attacker-controlled GitHub Apps to trigger workflows and inject malicious prompts. Anthropic said the bug could lead to disclosure of environment secrets, including credentials used to obtain OIDC tokens and Claude GitHub App installation tokens with write access, creating a path to repository takeover and broader supply-chain compromise. Microsoft Threat Intelligence separately showed that Claude Code’s `Read` tool was not sandboxed like its Bash tool, enabling access to sensitive runner data such as `/proc/self/environ` and leakage of secrets including `ANTHROPIC_API_KEY`. In lab testing, Microsoft demonstrated prompt-injection attacks that bypassed model safeguards and GitHub secret scanning to exfiltrate credentials through logs, comments, or external channels. Anthropic fixed the authorization issue within days of disclosure and later added hardening in `claude-code-action` `v1.0.94`, while the `/proc` exposure was mitigated in Claude Code `v2.1.128` by blocking access to sensitive procfs files; defenders were urged to treat AI-enabled CI/CD workflows processing untrusted issues, pull requests, and comments as high risk.
Aug 1, 2026
**Check Point Research** disclosed multiple critical vulnerabilities in Anthropic’s *Claude Code* AI coding assistant that could allow **remote code execution** and **credential theft** when a developer clones and opens an **untrusted repository**. The reported attack path abuses repository-controlled configuration and automation features (including **Hooks**, **MCP servers**, and **environment variables**) to trigger hidden shell command execution and to exfiltrate **Anthropic API credentials**, potentially enabling a pivot from a developer workstation into broader enterprise environments where Claude-related workflows and shared resources are accessible. The issues include consent-bypass and command-execution weaknesses tracked under **CVE-2025-59536** (covering closely related flaws involving repository configuration executing commands without adequate user consent) and an API credential exposure issue tracked as **CVE-2026-21852**, which affected *Claude Code* versions prior to **2.0.65** and enabled API key theft via malicious project configurations. Anthropic has **patched** the vulnerabilities and advised users to update to the latest version, while indicating additional hardening measures are planned to reduce supply-chain risk from malicious commits and repository-level configuration abuse.
Jun 29, 2026
Anthropic’s **Claude** platform suffered a widespread service disruption that affected users globally across the web app, mobile clients, and **Claude Code**, with reports of elevated errors, long response delays, hung sessions, and failed requests involving models such as `Opus 4.6` and `Sonnet 4.6`. User complaints rose sharply after the incident began around 0600 UTC, and Anthropic’s status page moved from reporting a partial outage to saying a fix had been implemented before later marking systems operational, though some customers continued to report intermittent problems after remediation. Separately, a security researcher disclosed a **critical supply-chain vulnerability** in Anthropic’s official **Claude Code GitHub Actions** workflow that could have allowed an unauthenticated attacker to compromise repositories using it, including Anthropic’s own. The flaw stemmed from write-permission checks that trusted any GitHub actor whose name ended with `[bot]`, enabling a malicious GitHub App bot to bypass restrictions and, when chained with prompt injection, potentially exfiltrate secrets, steal GitHub Actions `OIDC` credentials, obtain a privileged Claude GitHub App token, and push malicious code downstream; Anthropic said it patched the issues in `v1.0.94` with stronger actor validation and additional workflow hardening.
Jun 29, 2026