CVE-2026-48168
Received Received - Intake

Command Injection in PraisonAI via GitHub Actions Workflow

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-48168
EUVD
EUVD-2026-53575

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.40 (exc)
mervinpraison praisonai to 4.6.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in PraisonAI versions before 4.6.40. It occurs because the GitHub Actions workflow embeds an attacker-controlled pull request branch name into a Bash run block without proper quoting or validation. An attacker can exploit this by creating a malicious branch name with shell metacharacters and triggering the workflow via a @claude comment, even as an untrusted contributor.

Detection Guidance

This vulnerability is specific to PraisonAI versions prior to 4.6.40 and involves GitHub Actions workflows. Detection requires checking PraisonAI version and reviewing GitHub Actions workflow files for unsafe command injection patterns in the Claude workflow.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary shell commands on the GitHub Actions runner. This can lead to full repository compromise, including writing files, manipulating pull requests or issues, or abusing OIDC tokens for further attacks. The impact is severe due to the high privileges of the compromised job.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using PraisonAI may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.40 or later. Review and remove any @claude comment triggers in GitHub Actions workflows. Ensure branch names in pull requests are validated and sanitized before use in scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart