Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

anthropics/claude-code-action

              main @ 6c0083b
            

Fixes

CVEs

HIGH

Peak severity

56.3%

Coverage

Highlights

Command Injection: 8 prior fixes. Scrutinize any change in this area.

src/github/data/fetcher.ts: most-fixed (6 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Execution of shell-based commands using untrusted inputs (such as arbitrary branch names or file paths) led to critical command injection. Mitigation requires replacing dynamic shell evaluation with safe argument arrays.

Indirect Prompt Injection: Attackers can bypass prompt security by modifying pull request bodies, titles, or comments post-trigger. Stale-data fetchers and lack of temporal filtering allow injected content to enter the LLM context dynamically.

Remote Code Execution: Untrusted modifications to repository-level configurations like .claude/ and .mcp.json in a PR could trigger arbitrary code execution during workflow initialization. Restoring these files from a trusted base ref is essential before CLI execution.