#claude-code

Articles tagged with #claude-code

How a GitHub Triage Role Hijacked an Already-Authorized Claude Code Action Run
A GitHub collaborator with only the triage role could shift Claude Code Action's authorized trigger boundary and inject post-authorization input into a repository-writing run.
Aug 31, 202610 min read
Escaping Claude Code's Sandbox: A TOCTOU Bug That Let Repo Code Overwrite Host Files
A parent-directory swap timed against a permission check let sandboxed repo code redirect a host-owned file write. CVSS 7.7, High.
Aug 31, 202610 min read