CVE-2026-48168
PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name
Description
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.
INFO
Published Date :
Aug. 5, 2026, 7:17 p.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Update PraisonAI to version 4.6.40 or later.
- Review GitHub Actions workflows for command injection risks.
- Validate and quote all user-controlled input in scripts.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48168.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48168 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48168
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48168 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48168 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: PraisonAI de MervinPraison, Description: PraisonAI es un sistema de equipos multiagente. En versiones anteriores a la 4.6.40, el flujo de trabajo de Claude GitHub Actions incluido es vulnerable a la inyección de comandos porque incrusta un nombre de rama de solicitud de extracción controlado por el atacante en un bloque Bash run: sin comillas ni validación. Además, el flujo de trabajo permite que cualquier comentario @claude active el trabajo, independientemente de si el comentarista es un colaborador de confianza. Un colaborador externo puede abrir una solicitud de extracción desde un fork cuyo nombre de rama contenga metacaracteres de shell y comentar @claude, lo que hace que Bash ejecute código de shell arbitrario en el ejecutor de GitHub Actions. Debido a que estos comandos se ejecutan en un trabajo que posee un token de aplicación de GitHub con permisos de escritura, acceso OIDC y acceso gh/git, la inyección puede encadenarse a través de $GITHUB_PATH para comprometer pasos privilegiados posteriores, lo que permite escrituras en el repositorio, manipulación de solicitudes de extracción y problemas, o abuso de tokens OIDC. Este problema ha sido solucionado en la versión 4.6.40. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 05, 2026
Action Type Old Value New Value Added Reference https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xp85-6wwf-r67c Added SSVC {'id': 'CVE-2026-48168', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-05T19:23:57.492283Z'} -
New CVE Received by [email protected]
Aug. 05, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'MervinPraison', 'product': 'PraisonAI', 'versions': [{'status': 'affected', 'version': '< 4.6.40'}]}] Added Description PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-862 Added Reference https://github.com/MervinPraison/PraisonAI/commit/179cab02dbec0c1e9b601507a659 Added Reference https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xp85-6wwf-r67c