{"vulnerability": "CVE-2026-48168", "sightings": [{"uuid": "c0cb533e-788c-4b04-87cd-7f23432f981e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48168", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msecysnw6o2a", "content": "\ud83d\udd34 CVE-2026-48168 - Critical (10)\n\nPraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub A...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-48168/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T20:01:44.465474Z"}, {"uuid": "82067b48-86cd-48b8-bd05-b9a137955848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48168", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msedvztdh72a", "content": "CVE-2026-48168 - praisonai\nPraisonAI's GitHub Actions workflow is vulnerable to attacks if an unauthorized contributor submits a pull request with malicious branch name and comments '@claude'. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #CVE #infosec", "creation_timestamp": "2026-08-05T20:18:04.610458Z"}, {"uuid": "8ee71851-b4a9-425e-9794-052e2171d4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48168", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msfehhourb2w", "content": "PraisonAI <4.6.40 has a CRITICAL CVE-2026-48168 flaw: attackers can exploit GitHub Actions for command injection, risking repo takeover. Upgrade to 4.6.40 ASAP. https://radar.offseq.com/threat/cve-2026-48168-cwe-862-missing-authorization-in-mervinpraison-praisonai-b6d133d881efd541 #OffSeq #CVE202...", "creation_timestamp": "2026-08-06T06:00:29.956986Z"}, {"uuid": "20dead4a-45ef-47f9-bd7b-5996b6b7e307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48168", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117047035642701206", "content": "PraisonAI <4.6.40 is affected by CVE-2026-48168 (CRITICAL, CVSS 10): Missing authorization lets attackers exploit GitHub Actions, execute arbitrary shell commands, and compromise repos. Patch to 4.6.40! https://radar.offseq.com/threat/cve-2026-48168-cwe-862-missing-authorization-in-mervinpraison-praisonai-b6d133d881efd541 #OffSeq #CVE202648168 #SecDevOps", "creation_timestamp": "2026-08-06T06:00:30.871490Z"}]}