CVE-2026-48168

{
  "id": "CVE-2026-48168",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T19:17:31.070",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40."
    },
    {
      "lang": "es",
      "value": "PraisonAI es un sistema de equipos multiagente. En versiones anteriores a la 4.6.40, el flujo de trabajo de Claude GitHub Actions incluido es vulnerable a la inyección de comandos porque incrusta un nombre de rama de solicitud de extracción controlado por el atacante en un bloque Bash run: sin comillas ni validación. Además, el flujo de trabajo permite que cualquier comentario @claude active el trabajo, independientemente de si el comentarista es un colaborador de confianza. Un colaborador externo puede abrir una solicitud de extracción desde un fork cuyo nombre de rama contenga metacaracteres de shell y comentar @claude, lo que hace que Bash ejecute código de shell arbitrario en el ejecutor de GitHub Actions. Debido a que estos comandos se ejecutan en un trabajo que posee un token de aplicación de GitHub con permisos de escritura, acceso OIDC y acceso gh/git, la inyección puede encadenarse a través de $GITHUB_PATH para comprometer pasos privilegiados posteriores, lo que permite escrituras en el repositorio, manipulación de solicitudes de extracción y problemas, o abuso de tokens OIDC. Este problema ha sido solucionado en la versión 4.6.40."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MervinPraison",
          "product": "PraisonAI",
          "versions": [
            {
              "version": "< 4.6.40",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T19:23:57.492283Z",
          "id": "CVE-2026-48168",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MervinPraison/PraisonAI/commit/179cab02dbec0c1e9b601507a659",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xp85-6wwf-r67c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xp85-6wwf-r67c",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}