CVE-2026-40313 Details
Description
PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.
A vulnerability exists in PraisonAI, a multi-agent teams system, in GitHub Actions workflows prior to version 4.5.140. The issue arises from the default behavior of actions/checkout, which persists credentials by writing the GITHUB_TOKEN and sometimes ACTIONS_RUNTIME_TOKEN into the .git/config file. This credential leakage can be exploited by uploading artifacts that inadvertently include these tokens. In the case of PraisonAI, a public repository, leaked tokens can be accessed by any user with read permissions, potentially leading to a supply chain compromise. The vulnerability has been identified in multiple workflow and action files across the repository.
To address this vulnerability, update all actions/checkout steps to include persist-credentials: false. This prevents the GITHUB_TOKEN from being written into the .git/config file and leaking into uploaded artifacts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3959-6v5q-45q2 | [email protected] | Vendor Advisory |
| https://thehackernews.com/2024/08/github-vulnerability-artipacked-exposes.html | [email protected] | Press/Media Coverage |
| https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens | [email protected] | MitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| praison praisonai | < 4.5.140 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |