CVE-2026-48168 in PraisonAI
Summary
by MITRE • 08/05/2026
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within the PraisonAI multi-agent system where the bundled Claude GitHub Actions workflow contains critical command injection flaws that enable arbitrary code execution. The flaw stems from improper input validation and sanitization of user-controlled data, specifically the pull request branch name which is directly embedded into a Bash run block without proper quoting or validation mechanisms. This design pattern creates an environment where attacker-controlled input can be interpreted as shell commands rather than literal strings, violating fundamental security principles for command execution.
The vulnerability operates through a combination of two distinct attack vectors that together create a complete exploitation chain. First, the workflow accepts unvalidated branch names from external contributors and directly incorporates them into bash execution contexts without proper shell escaping or quoting. Second, the workflow permits job triggering via any @claude comment regardless of contributor trust level, removing access controls that would normally prevent unauthorized execution. This combination allows an attacker to craft a malicious pull request with a branch name containing shell metacharacters such as semicolons, pipes, or backticks, which then get executed when the workflow processes the comment.
The operational impact of this vulnerability is severe and encompasses multiple privilege escalation paths due to the elevated permissions granted to the GitHub Actions runner. The job executes with write permissions, OIDC access, and full gh/git capabilities through a GitHub App token, creating opportunities for extensive compromise beyond simple code execution. Attackers can leverage this access to manipulate repository contents, create malicious pull requests or issues, abuse OIDC tokens for authentication bypasses, and potentially escalate privileges further through manipulation of $GITHUB_PATH environment variables to influence subsequent workflow steps. This represents a critical security flaw that transforms a simple contributor interaction into a full compromise vector.
This vulnerability maps directly to CWE-78 "Improper Neutralization of Special Elements used in OS Command" and CWE-285 "Improper Authorization", with potential ATT&CK mappings to T1059.004 "Command and Scripting Interpreter: Unix Shell" and T1566.001 "Phishing: Spearphishing Attachment". The root cause aligns with the principle of least privilege violation where a workflow designed for limited automation has been granted excessive permissions without proper input sanitization controls. Mitigation strategies must include immediate patching to version 4.6.40 which addresses both the command injection vulnerability and access control issues, implementing proper input validation for all user-controlled data, adding authentication checks for workflow triggers, and reducing the privilege level of automated workflows where possible to limit potential damage from successful exploitation attempts.
The security implications extend beyond immediate code execution as this vulnerability demonstrates poor security design in automated workflow systems. The combination of unvalidated inputs, excessive permissions, and lack of access controls creates a dangerous environment where simple contributor interactions can result in complete repository compromise. This flaw highlights the importance of input validation in automation systems, particularly when these systems operate with elevated privileges. Organizations implementing similar multi-agent or CI/CD workflows must ensure proper sanitization of all user-controlled inputs and implement robust access control mechanisms to prevent unauthorized execution of privileged operations.
The fix implemented in version 4.6.40 addresses the core issues by introducing proper quoting and validation of branch names, along with implementing proper authorization checks for workflow triggers. This demonstrates the importance of maintaining security practices throughout software development lifecycle, particularly in automated systems that handle sensitive repository operations. The vulnerability serves as a reminder that even seemingly simple workflows can create dangerous attack surfaces when proper security controls are not implemented from the beginning of system design.