PraisonAI CVE-2026-40313: Overview of a Critical ArtiPACKED Supply Chain Vulnerability in GitHub Actions Workflows

Introduction

A default configuration in GitHub Actions workflows turned PraisonAI's public CI/CD pipeline into a credential dispensary, exposing tokens that could enable full supply chain compromise of a project with nearly 7,000 GitHub stars. CVE-2026-40313, scored at CVSS 9.1, shows how a single missing flag in a widely used GitHub Action can cascade into repository takeover, package poisoning, and secret theft.

PraisonAI is an open-source multi-agent AI framework created by Mervin Praison for building autonomous agent teams that can research, plan, code, and execute tasks. The project has reached the top of GitHub Trending, has 6.9k stars and 1.1k forks, and is distributed through both PyPI and Docker. Because it is a building block in AI tooling pipelines, it is a meaningful supply chain target. A compromise here reaches every downstream consumer who installs the package.

Technical Information

Root Cause: Credential Persistence in actions/checkout

The vulnerability comes from the default behavior of actions/checkout, one of the most commonly used GitHub Actions. When invoked without the persist-credentials: false option, this action writes the GITHUB_TOKEN (and in some cases the ACTIONS_RUNTIME_TOKEN) into the .git/config file inside the checked-out repository directory. It does this so that later git operations in the same job can authenticate automatically.

The problem starts when a later step in the workflow uploads artifacts (build outputs, logs, test results, or the checkout directory itself). If the upload includes the .git/ directory, the tokens in .git/config become part of the downloadable artifact.

The ArtiPACKED Race Condition

The attack vector, known as ArtiPACKED and documented by Palo Alto Networks' Unit 42 research team, exploits a timing window introduced in version 4 of the GitHub Actions artifacts feature. Before v4, artifacts could only be downloaded after the workflow run completed, so the GITHUB_TOKEN would typically have expired by the time anyone could access it. In version 4, artifacts can be downloaded while the workflow run is still in progress.

This creates a race condition. An attacker monitoring a public repository can:

1. Observe a workflow run starting (via the GitHub API or the Actions tab).
2. Poll for newly uploaded artifacts during the run.
3. Download the artifact before the workflow job completes.
4. Extract the GITHUB_TOKEN from .git/config within the artifact.
5. Use the still-valid token to perform authenticated operations against the repository.

What an attacker can do with a valid GITHUB_TOKEN depends on the token's permissions, but it can include pushing malicious commits, creating branches, modifying releases, and accessing repository secrets. For PraisonAI, this could mean poisoned PyPI packages, Docker images, or the release artifacts that downstream users depend on.

Scope Across PraisonAI Workflows

A security audit with the zizmor static analysis tool flagged multiple instances of this vulnerability across the PraisonAI repository, in numerous workflow and action YAML files under .github/workflows/ and .github/actions/. Affected files include:

Because PraisonAI is a public repository, any GitHub user with read access can download its workflow artifacts. The attack needs no special privileges and no user interaction, which contributes to the CVSS 9.1 severity rating.

Patch Information

The PraisonAI maintainers declared this vulnerability fixed in version 4.5.140, released on April 10, 2026, and published a GitHub Security Advisory (GHSA-3959-6v5q-45q2). The patch is simple in concept. Every actions/checkout step across the repository's GitHub Actions workflows and composite actions needed the persist-credentials: false option. This one flag stops the checkout action from writing the GITHUB_TOKEN into the .git/config file, which is the root cause of the ArtiPACKED credential leakage.

The advisory recommends this fix:

- name: Checkout repository
  uses: actions/checkout@v4
  with:
    persist-credentials: false

The v4.5.140 tag itself does not contain that change. Comparing the workflow files at the v4.5.140 tag with the current main branch shows that the persist-credentials: false additions were not yet present at the tag. At v4.5.140, for example, .github/workflows/docker-publish.yml still used a bare actions/checkout@v4 without the flag. The commit in v4.5.140 related to the issue (2cdc08e) updated only the security audit documentation and the install.sh sync process, not the workflows.

The workflow fixes landed on main in later commits. On the current main branch, persist-credentials: false has been applied across multiple files. .github/workflows/benchmark.yml on main, for instance, now has a clean fix:

- name: Checkout repository
  uses: actions/checkout@v4
  with:
    persist-credentials: false

In .github/actions/claude-issue-triage-action/action.yml, the new flag sits correctly alongside existing with: parameters such as fetch-depth: 0.

A Caveat: Duplicate YAML Keys in Some Workflow Files

Some workflow files on main have duplicate with: blocks, a YAML syntax issue likely introduced by an automated patching tool. .github/workflows/release.yml on main, for example, shows this pattern:

- name: Checkout upstream repo
  uses: actions/checkout@v4
  with:
    persist-credentials: false
  with:
    persist-credentials: false
  with:
    repository: MervinPraison/PraisonAI
    ref: ${{ github.event.inputs.tag }}
    fetch-depth: 0

When duplicate keys exist at the same mapping level in YAML, most parsers, including the one GitHub Actions uses, keep only the last value. In the snippet above, the effective with: block is {repository: ..., ref: ..., fetch-depth: 0}, and persist-credentials: false is not in it. The fix may therefore be incomplete or ineffective for workflow files like release.yml that already had with: parameters.

Users should upgrade to at least v4.5.140, and ideally to the latest release, to get the declared fix. They should also independently verify that their fork's or deployment's workflow files contain a correctly structured persist-credentials: false entry inside a single with: block for each checkout step.

Affected Systems and Versions

The vulnerability affects PraisonAI versions 4.5.139 and below, and the fix was declared in version 4.5.140. Later secure releases include version 4.5.145 on PyPI (April 10, 2026) and version 4.6.1 on GitHub Releases (April 12, 2026).

Anyone who has forked the PraisonAI repository and kept the original GitHub Actions workflow configurations is also potentially affected, whatever PraisonAI library version they use. The vulnerability is in the CI/CD configuration, not in the application code.

The CWE classification is CWE-829: Inclusion of Functionality from Untrusted Control Sphere.

Vendor Security History

PraisonAI received a cluster of security advisories in April 2026. The vendor responded quickly, patching CVE-2026-40313 in version 4.5.140 and continuing to release updated versions. Given the number of recent critical advisories and the incomplete patch application described above, consumers should keep monitoring the project's security advisories page for new disclosures and verify fixes independently.

References

• NVD: CVE-2026-40313
• CVE Record: CVE-2026-40313
• GitHub Security Advisory: GHSA-3959-6v5q-45q2
• Unit 42: ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts
• The Hacker News: GitHub Vulnerability ArtiPACKED Exposes Repositories to Potential Takeover
• PraisonAI v4.5.140 Release
• PraisonAI v4.5.139 to v4.5.140 Comparison
• Patch Commit 2cdc08e
• docker-publish.yml at v4.5.140
• docker-publish.yml on main
• release.yml on main
• benchmark.yml on main
• claude-issue-triage-action/action.yml on main