The insecure use of the actions/checkout GitHub Action in PraisonAI releases 4.5.139 and earlier results in the GITHUB_TOKEN and, in some cases, the ACTIONS_RUNTIME_TOKEN being written to the .git/config file. When any subsequent workflow step uploads artifacts—such as build logs, test results, or other build outputs—the credentials may be embedded in those files. An attacker who can read the repository obtains these artifacts and extracts the leaked tokens. With these tokens, the attacker can push malicious code, poison releases on PyPI or Docker, and potentially compromise downstream users. This behavior demonstrates an improper restriction of remote access (CWE‑829).

MervinPraison's PraisonAI multi‑agent systems up to version 4.5.139 are affected. The vulnerability has been corrected in version 4.5.140. No other vendors or product variants are listed.

The flaw carries a CVSS score of 9.1, indicating a high severity. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog. Because the repository is public and artifacts are publicly downloadable, the likely attack vector is through any user with read access pulling artifacts that contain the leaked credentials. The vulnerability is tractable and could be exploited unimpeded as long as the unrepaired workflow remains in place, resulting in unauthorized code injection or supply‑chain compromise.