CVE-2026-40313: PraisonAI: GitHub Actions credential leakage via persisted tokens (ArtiPACKED)
PraisonAI versions up to and including 4.5.139 have GitHub Actions workflows that check out code without disabling credential persistence, which can leave the GITHUB_TOKEN in the local git configuration. If later steps upload those directories as artifacts, the tokens may become reachable by anyone who can download them from this public repository. The record states the issue is fixed in 4.5.140 and reports a CVSS score of 9.1, while no confirmed exploitation appears in the sources consulted.
Overview
PraisonAI is a multi-agent teams system. The available record describes its GitHub Actions workflows as affected by the ArtiPACKED pattern, in which credentials written by actions/checkout during a run can end up in uploaded build artifacts. The issue is fixed in version 4.5.140, according to the record and the GitHub security advisory.
Impact
- Tokens such as GITHUB_TOKEN may be stored in the local git configuration during checkout and then included in artifacts.
- The record describes possible consequences including unauthorized code pushes, tampering with releases and packages, and exposure of repository secrets.
- The available records rate the issue as critical, with a CVSS score of 9.1.
Affected products and versions
- MervinPraison PraisonAI: versions before 4.5.140 are listed as affected, with versions up to and including 4.5.139 described as vulnerable.
- Praison Praisonai: the same range before 4.5.140 is listed.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- The SSVC record shows exploitation as none.
- The EPSS probability in the record is 0.00511.
- No confirmed active exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade PraisonAI to version 4.5.140, which the record identifies as the fix.
- Review GitHub Actions workflows and disable credential persistence in checkout steps where the token is not needed later in the job.
- Restrict which workflow steps can upload artifacts and exclude git metadata from uploads.
- If artifacts from affected runs may have been exposed, rotate the relevant tokens and secrets. The Unit 42 advisory is listed in the record as a mitigation reference.
Detection guidance
- Audit workflow files under the repository workflow and action directories for checkout steps that do not disable credential persistence.
- Review artifact upload steps to confirm whether they could capture repository metadata or configuration files.
- Review the list of artifacts produced by public workflow runs and the access activity on them.
- Look for unexpected repository, release or package activity that could indicate misuse of exposed credentials.
Limitations of the available information
- The record does not enumerate every affected workflow file beyond the directories named.
- It is not confirmed from the record whether any real-world artifacts contained tokens.
- The record's EPSS date is later than the publication date, so the EPSS value should be treated with caution.
- The CWE name is not provided in the record; only the identifier CWE-829 is given.
Frequently asked questions
Which PraisonAI versions are affected by this issue?
The record describes versions up to and including 4.5.139 as vulnerable, and lists the affected range as before 4.5.140.
Is this vulnerability known to be actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.
What should maintainers do first?
Upgrade to version 4.5.140, review checkout steps that persist credentials, and rotate tokens if artifacts from affected runs may have been exposed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.