CVE-2026-48168 MervinPraison CVE debrief

Who should care

Users of PraisonAI versions prior to 4.6.40, administrators of GitHub Actions workflows, security teams monitoring for potential command injection vulnerabilities, and operators managing PraisonAI deployments are advised to review and update their systems. This includes assessing the vulnerability's impact on their specific environments, planning vendor-supported updates or mitigations, and implementing compensating controls for exposed systems while remediation is scheduled and verified. Additionally, affected stakeholders should monitor GitHub Actions workflow logs for suspicious activity and implement additional security measures for GitHub App tokens to prevent potential abuse and unauthorized access to sensitive resources. Reviewing and restricting GitHub Actions workflow permissions to least privilege is also recommended to minimize the attack surface. Furthermore, tracking exceptions, retesting remediated assets, and documenting evidence are crucial steps in ensuring the vulnerability is properly addressed and managed within their environments. This involves coordination between development, operations, and security teams to ensure a comprehensive response to the vulnerability and to prevent potential exploitation by attackers. The CVE record was published on 2026-08-05T19:17:31.070Z and has not been modified since then, emphasizing the need for immediate attention to this critical vulnerability. The vulnerability's severity and potential impact underscore the importance of prompt action to protect against potential threats and maintain the security and integrity of affected systems and data. Therefore, it is essential for all relevant stakeholders to take proactive measures to address this vulnerability and ensure the security of their environments. This includes staying informed about the vulnerability's details, following vendor guidance, and implementing necessary controls to prevent exploitation. By taking these steps, organizations can minimize the risk associated with this vulnerability and protect their assets from potential threats. The vulnerability's details and potential impact highlight the need for a thorough and coordinated response to this

Technical summary

The Claude GitHub Actions workflow in PraisonAI versions prior to 4.6.40 is vulnerable to command injection. An attacker can exploit this by creating a pull request with a malicious branch name and commenting @claude, leading to arbitrary shell code execution in the GitHub Actions runner. This can result in repository writes, pull request and issue manipulation, or OIDC-token abuse due to the job's elevated permissions.

Defensive priority

GitHub Actions workflow command injection vulnerability in PraisonAI prior to version 4.6.40 allows for arbitrary shell code execution, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse.

Recommended defensive actions

• Review and update PraisonAI to version 4.6.40 or later
• Restrict GitHub Actions workflow permissions to least privilege
• Monitor GitHub Actions workflow logs for suspicious activity
• Implement additional security measures for GitHub App tokens
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-48168 issue arises from a command injection vulnerability in the Claude GitHub Actions workflow of PraisonAI versions prior to 4.6.40. This vulnerability is due to the embedding of an attacker-controlled pull request branch name into a Bash run block without proper quoting or validation. Furthermore, the workflow is designed to trigger jobs from any @claude comment, irrespective of the commenter's status as a trusted collaborator. An external contributor can exploit this by opening a pull request from a fork with a branch name containing shell metacharacters and commenting @claude. This causes Bash to execute arbitrary shell code in the GitHub Actions runner. Given that these commands run in a job with a GitHub App token that has write permissions, OIDC access, and gh/git access, the injection can be escalated through $GITHUB_PATH to compromise later privileged steps. This escalation can lead to repository writes, manipulation of pull requests and issues, or abuse of OIDC tokens.

Official resources