CVE-2026-40313

{
  "id": "CVE-2026-40313",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-14T04:17:13.890",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140."
    },
    {
      "lang": "es",
      "value": "PraisonAI es un sistema de equipos multiagente. En las versiones 4.5.139 e inferiores, los flujos de trabajo de GitHub Actions son vulnerables al ataque ArtiPACKED, un vector conocido de fuga de credenciales causado por el uso de actions/checkout sin establecer persist-credentials: false. Por defecto, actions/checkout escribe el GITHUB_TOKEN (y a veces el ACTIONS_RUNTIME_TOKEN) en el archivo .git/config para persistencia, y si cualquier paso de flujo de trabajo posterior sube artefactos (salidas de compilación, registros, resultados de pruebas, etc.), estos tokens pueden ser incluidos inadvertidamente. Dado que PraisonAI es un repositorio público, cualquier usuario con acceso de lectura puede descargar estos artefactos y extraer los tokens filtrados, lo que podría permitir a un atacante insertar código malicioso, envenenar lanzamientos y paquetes PyPI/Docker, robar secretos del repositorio y ejecutar un compromiso completo de la cadena de suministro que afecte a todos los usuarios posteriores. El problema abarca numerosos archivos de flujo de trabajo y de acción en .github/workflows/ y .github/actions/. Este problema ha sido solucionado en la versión 4.5.140."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MervinPraison",
          "product": "PraisonAI",
          "versions": [
            {
              "version": "< 4.5.140",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T15:38:40.800881Z",
          "id": "CVE-2026-40313",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.5.140",
              "matchCriteriaId": "FD852D9F-8355-4F4D-BCD7-6897A46FF1E9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3959-6v5q-45q2",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://thehackernews.com/2024/08/github-vulnerability-artipacked-exposes.html",
      "source": "[email protected]",
      "tags": [
        "Press/Media Coverage"
      ]
    },
    {
      "url": "https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    }
  ]
}