CVE-2026-48168

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40

Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or validation. Furthermore, the workflow permits any user to trigger the job via an @claude comment, regardless of their collaborator status. An external contributor can exploit this by creating a pull request from a fork with a branch name containing shell metacharacters and commenting @claude, leading to the execution of arbitrary shell code within the GitHub Actions runner. Since the job possesses a GitHub App token with write permissions, OIDC (OpenID Connect) access, and gh/git access, the injection can be leveraged through the $GITHUB PATH variable to compromise subsequent privileged steps, potentially allowing repository writes, manipulation of issues and pull requests, or abuse of the OIDC token.

Recommendations Update to version 4.6.40.