CVE-2026-48168 PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name
Attackers can execute arbitrary shell commands in GitHub Actions runners via unquoted PR branch names, potentially compromising repository access and OIDC tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48168?
CVE-2026-48168 is a critical command injection vulnerability in MervinPraison PraisonAI, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.
Weakness: CWE-862
Which versions are affected by CVE-2026-48168?
How do I fix CVE-2026-48168?
No fix has been published for CVE-2026-48168 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-48168 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48168 exists.
Sources
Also known as GHSA-xp85-6wwf-r67c.