CVE-2026-48168 affects MervinPraison's PraisonAI multi-agent teams system in versions before 4.6.40. The vulnerability arises from the bundled Claude GitHub Actions workflow embedding an unquoted, attacker-controlled pull request branch name into a Bash run block, enabling command injection. Additionally, the workflow triggers on any @claude comment without verifying if the commenter is a trusted collaborator. An attacker can open a pull request from a fork with a malicious branch name containing shell metacharacters and comment @claude to execute arbitrary shell commands in the GitHub Actions runner. Since the job runs with a GitHub App token that has write permissions, OIDC access, and git access, the attacker can chain this injection to compromise subsequent privileged steps, potentially modifying repository contents, manipulating pull requests and issues, or abusing OIDC tokens. The vulnerability is resolved in PraisonAI version 4.6.40.

Successful exploitation allows unauthenticated attackers to execute arbitrary shell commands within the GitHub Actions runner environment. This can lead to full repository compromise including write access, manipulation of pull requests and issues, and abuse of OIDC tokens for further privilege escalation. The vulnerability has a CVSS 3.1 score of 10.0 (critical), indicating maximum impact on confidentiality, integrity, and availability.

Upgrade PraisonAI to version 4.6.40 or later, where this vulnerability has been fixed. Until then, restrict GitHub Actions workflows to trusted collaborators and avoid triggering jobs based on unverified comments. Review and validate any inputs embedded in shell commands within workflows to prevent command injection.