PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.
The issue stems from the use of actions/checkout without setting the persist-credentials: false option. By default, this action saves GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) to the .git/config file to maintain authentication session. If subsequent workflow steps upload artifacts (build results, logs, test results, etc.), these files may contain the mentioned tokens. Since PraisonAI is a public repository, anyone can download these artifacts and extract valid authentication tokens from them. The issue affects multiple workflow files and actions in the .github/workflows/ and .github/actions/ directories.
An attacker who obtains the token can push malicious code to the repository, poison releases and PyPI and Docker packages, steal repository secrets, and consequently conduct a full supply chain attack affecting all users using PraisonAI packages.
PraisonAI should be updated to version 4.5.140, in which the issue has been fixed. Additionally, it is recommended to use the persist-credentials: false option in all actions/checkout calls in CI/CD pipelines and regularly audit workflow artifacts for the presence of sensitive data.
PraisonAI (Praison Praisonai) in versions 4.5.139 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NPraison Praisonai
APPPraison< 4.5.140
Related vulnerabilities
Path Traversal i RCE w PraisonAI MCP Server (serwer narzędzi plikowych)
Command Injection w PraisonAI — brak walidacji poleceń MCP
PraisonAI — RCE i command injection przez niezaufowane pliki YAML
PraisonAI – nieuwierzytelnione przejęcie sesji przeglądarki przez WebSocket
Path traversal w PraisonAI — nadpisywanie plików przez złośliwy pakiet .praison