CVE-2026-48168 MervinPraison CVE debrief

Who should care

GitHub Actions users, PraisonAI administrators, and security teams responsible for monitoring and mitigating vulnerabilities in development workflows should assess exposure and apply the fix.

Why it matters

CVE-2026-48168 is a critical vulnerability allowing command injection in PraisonAI's GitHub Actions workflow. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity.

• Potential for repository writes and manipulation
• Possible OIDC-token abuse through compromised GitHub App tokens
• Risk of pull request and issue manipulation
• Need for verification of affected systems and exposure

Technical summary

The PraisonAI system, specifically versions prior to 4.6.40, contains a command injection vulnerability in its Claude GitHub Actions workflow. This vulnerability occurs because the workflow embeds an attacker-controlled pull request branch name into a Bash run block without proper quoting or validation. Furthermore, the workflow is triggered by any @claude comment, regardless of the commenter's status as a trusted collaborator. An outside contributor can exploit this by opening a pull request from a fork with a branch name containing shell metacharacters and commenting @claude. This causes Bash to execute arbitrary shell code in the GitHub Actions runner. Since these commands run in a job with a GitHub App token holding write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps. This enables repository writes, pull request and issue manipulation, or OIDC-token abuse.

Defensive priority

High priority for GitHub Actions users and PraisonAI administrators to assess exposure and apply the fix.

Recommended defensive actions

• Assess exposure by checking if using PraisonAI versions prior to 4.6.40
• Verify GitHub Actions workflows for suspicious activity
• Restrict write permissions and OIDC access in GitHub App tokens
• Monitor for unusual repository or pull request activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, additional information on potential exploitation and affected systems is limited. Defenders should verify PraisonAI version usage, review GitHub Actions workflows for suspicious activity, and monitor for unusual repository or pull request activity. The vulnerability allows an outside contributor to execute arbitrary shell code by opening a pull request with a malicious branch name and commenting @claude, potentially leading to writes,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.