PraisonAI Claude Workflow Command Injection via Unquoted Branch Name

GitHub Actions Claude workflow command injection via unquoted PR branch name Vulnerability Overview Vulnerability Type: Command Injection Vulnerability Description: This vulnerability exists in the GitHub Actions workflow. An attacker can execute arbitrary commands within the workflow's block by crafting a malicious branch name. Affected Component: workflow job Trigger Conditions: External contributors can create a branch containing shell metacharacters and trigger the job by commenting on the Pull Request (PR). The workflow reads the PR data header references and interpolates them directly into Bash commands. Security Boundary Violation: The workflow is designed to allow Claude to respond to GitHub Issues and PRs while utilizing privileged repository automation. Unvalidated user input (the PR branch name) is used directly to execute shell commands, resulting in a violation of security boundaries. Impact Scope Affected Versions: package version Fixed Version: CVSS Score: 10.0 / 10 (Critical) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High Remediation Fix: Upgrade the package to version . POC Code Vulnerable Code Example Root Cause Root Cause: GitHub PR branch names are not safe to embed directly into shell scripts. Git allows branch names to contain special characters such as , , , , and . When inserted into the vulnerable line, these characters are parsed as multiple commands. Security Reproduction Reproduction Steps: 1. Install a canary workflow in the target repository. 2. Fork the target repository from a non-collaborator account. 3. Create a maliciously named branch in the attacker's fork. 4. Open a PR against the target repository and trigger the action. 5. Expected Result: The workflow logs show that the branch name is interpreted as shell syntax, and the injected commands are executed. Proof of Concept Proof: Through controlled reproduction, it was demonstrated that the attacker-controlled branch name reached the target repository's workflow. The branch name was interpreted by Bash as shell syntax, and the injected commands were written to . The next step resolved from the attacker-controlled path. This exploitation chain does not depend on LLM behavior. Impact Impact: In the actual Claude workflow, the vulnerable step runs before . The subsequent step receives and , and is granted , , , , and permissions, allowing execution of and . Consequently, a successful exploit can affect the command environment used by the privileged Claude steps. The security canary uses to replace with . The same primitives can be used to influence subsequent or executions, modify workspace files (which are then modified by the next step), or alter GitHub Actions state files. Why the Attacker Model is Realistic Attacker Model: An attacker only needs the ability to: 1. Create a public fork. 2. Push a valid Git branch name containing shell metacharacters. 3. Open a PR against the target repository. 4. Comment on the PR. Repository membership is not required; the controlled reproduction used two separate GitHub accounts.

Goal Reached Thanks to every supporter — we hit 100%!

PraisonAI Claude Workflow Command Injection via Unquoted Branch Name

More from this source