diff --git a/src/entrypoints/run.ts b/src/entrypoints/run.ts
index 2ab42f1..5e7239e 100644
--- a/src/entrypoints/run.ts
+++ b/src/entrypoints/run.ts
@@ -47,6 +47,11 @@ import type { ClaudeRunResult } from "../../base-action/src/run-claude-sdk";
 async function installClaudeCode(): Promise<void> {
   const customExecutable = process.env.PATH_TO_CLAUDE_CODE_EXECUTABLE;
   if (customExecutable) {
+    if (/[\x00-\x1f\x7f]/.test(customExecutable)) {
+      throw new Error(
+        "PATH_TO_CLAUDE_CODE_EXECUTABLE contains control characters (e.g. newlines), which is not allowed",
+      );
+    }
     console.log(`Using custom Claude Code executable: ${customExecutable}`);
     const claudeDir = dirname(customExecutable);
     // Add to PATH by appending to GITHUB_PATH