CVE-2026-48168
CriticalCVSS 10.0Summary
PraisonAI before 4.6.40 contains a command injection vulnerability in the bundled Claude GitHub Actions workflow. The pull request branch name is embedded in a Bash block without validation, and any @claude comment can trigger the job, allowing outside contributors to execute arbitrary code in the runner.
Risk Assessment
Risk of repository takeover, manipulation of pull requests and issues, and OIDC token abuse, potentially leading to serious security breaches in the CI/CD pipeline.
Recommendation
Update PraisonAI to version 4.6.40 or later. Restrict workflow triggering to trusted commenters only.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.