CVE-2026-48168: PraisonAI Command Injection Vulnerability

CVE-2026-48168 Overview

CVE-2026-48168 is a command injection vulnerability in PraisonAI, a multi-agent teams system maintained by MervinPraison. The bundled Claude GitHub Actions workflow embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. The workflow also triggers on any @claude comment without verifying that the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork with shell metacharacters in the branch name, then comment @claude to execute arbitrary shell code in the GitHub Actions runner. The issue is fixed in PraisonAI version 4.6.40.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands in a privileged GitHub Actions runner, gaining write access to the repository, OIDC token abuse, and compromise of downstream privileged steps.

Affected Products

PraisonAI versions prior to 4.6.40
Repositories using the bundled Claude GitHub Actions workflow
CI/CD pipelines relying on the vulnerable workflow with a GitHub App token

Discovery Timeline

2026-08-05 - CVE-2026-48168 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-48168

Vulnerability Analysis

The vulnerability is a Command Injection flaw [CWE-862: Missing Authorization] in the Claude GitHub Actions workflow shipped with PraisonAI. The workflow expands github.head_ref — the source branch of a pull request — directly into a Bash run: step. GitHub allows branch names to contain shell metacharacters such as backticks, $(), and semicolons. When the workflow runs, Bash evaluates these metacharacters and executes attacker-controlled commands.

Compounding the injection, the workflow lacks an authorization check on the commenter. Any GitHub user can trigger the job by posting an @claude comment on a pull request, including outside contributors from forks. This eliminates the trust boundary normally provided by requiring collaborator status.

Because the runner holds a GitHub App token with write permissions, OIDC access, and gh/git access, injected commands can modify $GITHUB_PATH to poison later privileged steps. Attackers can then push commits, manipulate pull requests and issues, or abuse the OIDC token to pivot into connected cloud environments.

Root Cause

The root cause is unsafe interpolation of github.head_ref into a shell command combined with missing authorization on the workflow trigger. GitHub Actions expression syntax substitutes the value verbatim before Bash parses the line, so any shell metacharacter in the branch name becomes executable code.

Attack Vector

An attacker forks the target repository, creates a branch whose name contains shell metacharacters, and opens a pull request. The attacker then comments @claude on the pull request, which triggers the vulnerable workflow. Bash interprets the injected metacharacters and executes the attacker's payload inside the runner with the workflow's full token privileges.

python

# Post-patch input validation added in the same hardening commit
# Source: https://github.com/MervinPraison/PraisonAI/commit/179cab02dbec0c1e9b601507a659
def _process_url_mention(self, url: str) -> Optional[str]:
    """Process @url:https://... mention."""
    try:
        from praisonaiagents.tools.spider_tools import SpiderTools

        if not SpiderTools()._validate_url(url):
            return f"# URL: {url}\n[Blocked: URL is not allowed]"

        import urllib.request

        req = urllib.request.Request(

Detection Methods for CVE-2026-48168

Indicators of Compromise

Pull requests originating from forks with branch names containing backticks, $(, ;, &&, |, or newline characters.
Unexpected @claude comments from non-collaborator accounts on public repositories.
GitHub Actions run logs showing shell expansions in steps that reference github.head_ref or github.event.pull_request.head.ref.
Unattributed commits, pull request edits, or issue changes performed by the GitHub App token during a Claude workflow run.

Detection Strategies

Audit workflow YAML for direct interpolation of github.head_ref, github.event.pull_request.title, or other untrusted fields inside run: blocks.
Review GitHub audit logs for workflow runs triggered by issue_comment events where the actor is not a repository collaborator.
Correlate OIDC token issuance events with workflow runs originating from forked pull requests.

Monitoring Recommendations

Enable GitHub audit log streaming and alert on workflow_run events tied to fork-based pull requests with anomalous branch names.
Monitor cloud provider IAM logs for OIDC role assumptions initiated by GitHub Actions during untrusted pull request workflows.
Track modifications to $GITHUB_PATH and unexpected binaries introduced during CI runs.

How to Mitigate CVE-2026-48168

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 or later, which contains the workflow fix.
Rotate any GitHub App tokens, OIDC-derived cloud credentials, and secrets exposed to the vulnerable workflow.
Review recent workflow runs and repository history for unauthorized commits, pull request edits, or issue changes.

Patch Information

The fix is included in PraisonAI 4.6.40. See the GitHub Security Advisory GHSA-xp85-6wwf-r67c and the remediation commit for full details. The patch quotes untrusted inputs, restricts the workflow trigger to trusted collaborators, and adds broader input validation across related tooling.

Workarounds

Disable or remove the bundled Claude GitHub Actions workflow until the upgrade is applied.
Restrict the workflow trigger by gating on github.event.comment.author_association values such as OWNER, MEMBER, or COLLABORATOR.
Assign github.head_ref to an intermediate environment variable and reference the variable with quotes inside the run: block instead of using expression interpolation.
Reduce the workflow token scope with permissions: set to read-all or the minimum required, and disable OIDC where not required.

bash

# Example: safe handling of untrusted branch names in workflow steps
- name: Safe branch handling
  env:
    HEAD_REF: ${{ github.head_ref }}
  run: |
    printf 'branch=%q\n' "$HEAD_REF"