Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration (CVE-2026-47751) | HOL Guard CVE