Back to the CVE list

CVE-2026-48168Proof of concept (PoC) published · CISASuited to automated attack · CISA

PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name

CVSS score

10.0

EPSS probability

%1.5

Risk score

0.2

Published

2 mo ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.8

CVE-2026-57124PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

VendorMervinPraison ProductPraisonAI

Patch status unknownEPSS %11 mo ago

9.8

CVE-2026-57131praisonai: Jobs API exposes agent-execution endpoints with no authentication

VendorMervinPraison ProductPraisonAI

Patch status unknownEPSS %11 mo ago

9.8

CVE-2026-57123PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

VendorMervinPraison Productpraisonaiagents

Patch status unknownEPSS %11 mo ago

9.8

CVE-2026-57127praisonai: recipe serve auth middleware silently disables itself when no secret is set

VendorMervinPraison ProductPraisonAI

Patch status unknownEPSS %11 mo ago

9.8

CVE-2026-57147praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

VendorMervinPraison ProductPraisonAI+1 etkilenen

Patch status unknownEPSS %11 mo ago

9.8

CVE-2026-57139PraisonAI MCPServer exposes unauthenticated HTTP tools/call

VendorMervinPraison ProductPraisonAI

Patch status unknownEPSS %11 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-48168"