A critical command injection vulnerability in PraisonAI allows unauthenticated attackers to execute arbitrary code within GitHub Actions workflows by leveraging unvalidated pull request branch names.

This is a Missing Authorization and Command Injection (CWE-862) flaw within the Claude GitHub Actions workflow. The system fails to validate the pull request branch name and improperly handles user comments, allowing an attacker to inject shell metacharacters that are executed by the GitHub runner with elevated privileges.

Exploitation of this flaw allows an attacker to execute arbitrary code within a privileged GitHub Actions environment. This can result in repository compromise, unauthorized access to OIDC tokens, and the ability to manipulate pull requests or issues, leading to a significant breach of the development lifecycle and supply chain integrity.

Immediate Action: Update MervinPraison PraisonAI to version 4.6.40 or later immediately. This update addresses the improper handling of untrusted input in the GitHub workflow.

Proactive Monitoring: Review GitHub Actions workflow logs for suspicious activity or unexpected command execution. Audit the permissions assigned to the GitHub App token associated with these workflows.

Compensating Controls: Implement stricter branch protection rules and limit the ability of external contributors to trigger workflows until the patch is applied.

Public Exploit Available: false

The severity of this issue is absolute, as it directly facilitates supply chain compromise. All users of PraisonAI must upgrade to version 4.6.40 without delay to secure their CI/CD environments against unauthorized code execution.