Skip to content

v2.0.4 — P0 comment-and-control fix

Choose a tag to compare

View all tags
@nsportsman nsportsman released this 19 Apr 16:42
v2.0.4
1da9a5e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

P0 fix (CVSS 9.4, Anthropic bounty-acknowledged)

Closes the "comment and control" attack path that was still reachable in v2.0.3:

  1. External contributor opens PR with prompt-injection payload in body/diff
  2. Internal maintainer comments @claude to request review
  3. v2.0.3's author_association check on the commenter passes (MEMBER)
  4. Claude reads PR body/diff = external content → follows injected instructions
  5. Within allowed tools (Bash(gh pr comment:*)), Claude exfiltrates secrets/env

Fixes

  • P0-1: pull_request_review_comment now requires BOTH the commenter AND the PR author to be insiders. @claude on external PR blocked at trigger.
  • P0-2: Explicit track_progress: "false" — locks the action against #860 union-merge if upstream default ever flips.
  • Expanded --disallowedTools: + Bash(git add|commit|push|rm:*).
  • --append-system-prompt defensive preamble: system-level instruction to treat PR content as untrusted, never read secrets/env, stop on injection attempts.

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@1da9a5e29de06e850035b01e1ab5c0e19435ba30  # v2.0.4

All prior v2.0.x callers should bump to v2.0.4 — see ENG-3113.

Assets 2
Loading