// ClaudeMEDIUM
Anthropic patched a vulnerability in the Claude Code GitHub Action (versions prior to v2.1.128, released May 5, 2026) that allowed attackers to exfiltrate CI/CD secrets by accessing unsanitized environment variables via /proc/self/environ. Successful exploitation enables attackers to steal AWS IAM keys, database passwords, and SSH tokens from development pipelines. All users of the Claude Code GitHub Action must upgrade immediately.
// Get alerts for Claude