CVE-2026-48168: PraisonAI command injection via pull request branch name

Summary

PraisonAI versions prior to 4.6.40 ship a Claude GitHub Actions workflow that embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Any @claude comment can trigger the job, so an outside contributor can open a fork PR with shell metacharacters in the branch name and execute arbitrary shell code on the runner. Because the job holds a GitHub App token with write permissions, OIDC access and gh/git access, the injection can chain through $GITHUB_PATH to repository writes, pull request and issue manipulation, or OIDC-token abuse.

Mitigation

This issue has been fixed in version 4.6.40.

Related items

• MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSimilar attack · BleepingComputer
• HighGHSA-64vx-6h2c-rjh7: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCESimilar attack · GitHub Advisory Database
• MediumHacking on Autopilot: Inside ARTEX Cybercrime CampaignsSimilar attack · Check Point Research
• MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
• MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database