In affected versions of PraisonAI the bundled Claude GitHub Actions workflow injects the pull request branch name directly into a Bash run block without quoting or validation, allowing shell metacharacters to be executed. The trigger is any @claude comment, and there is no restriction on who may comment; thus an outsider can create a pull request from a fork, craft a branch name containing malicious commands, comment @claude, and cause the runner to execute arbitrary shell code. Because the job runs with a GitHub App token that has write permissions, OIDC access, and GitHub CLI access, the injected commands can manipulate the repository (writes, review comments, issue creation), tamper with future job steps via $GITHUB_PATH, or abuse the OIDC token for elevated access elsewhere.

Products: MervinPraison PraisonAI, all releases before version 4.6.40 that include the bundled Claude GitHub Actions workflow. Users of older releases should verify the workflow configuration and version.

The severity is maximum with a CVSS score of 10, and the EPSS score is not available, indicating no data but still a high theoretical risk. The exploit path requires only that a contributor be able to open a pull request from a fork and post an @claude comment; this is trivial for public repositories or repositories that allow forked PRs. The unauthenticated trigger combined with privileged runner permissions means any attacker who can inject the branch name immediately gains full write and OIDC capabilities, enabling repository corruption, data exfiltration, or further lateral movement. Because this is a command injection in a build environment, any successful exploitation would effectively bypass the repository’s integrity controls.