Command injection in PraisonAI GitHub Actions Claude workflow via PR branch name (CVE-2026-48168)

The bundled Claude GitHub Actions workflow in PraisonAI embeds an attacker-controlled pull request branch name directly into a Bash run block without quoting or validation, enabling shell command injection. Any outside contributor can open a pull request from a fork with a branch name containing shell metacharacters and comment @claude to trigger the vulnerable job, since the workflow does not restrict execution to trusted collaborators. Because the job holds a GitHub App token with write permissions and OIDC access, the injection can be chained to perform repository writes, pull request and issue manipulation, or OIDC token abuse. Affected versions: - <= 4.6.39 We recommend updating to: >= 4.6.40. CVSS 10.0 · our assessment: act_now Reference: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xp85-6wwf-r67c Details: https://vuln.today/cve/CVE-2026-48168