# CVE-2026-40313: PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to…

Source: https://junglewise.ai/threats/cve-2026-40313-praisonai-is-a-multi-agent-teams-system-in-versions-4-5-139-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14  
License: CC BY 4.0 with a link back

CVE-2026-40313 · Severity: critical · CVSS 9.1 · Published 2026-04-14

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.

Technologies: [Praisonai](https://junglewise.ai/threats/technologies/praisonai). Vendors: [Praison](https://junglewise.ai/threats/vendors/praison).

## Quick answers

**Is CVE-2026-40313 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40313 being exploited in the wild.

**How severe is CVE-2026-40313?** Critical severity, with a CVSS score of 9.1, published 14 April 2026.

**Which products and versions are affected?** Praisonai. The advisory does not name versions.

**Is there a fix for CVE-2026-40313?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-40313?** Check whether you run Praisonai. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Praisonai

## Related threats

- [PraisonAI HTTPApproval dashboard XSS and auto-approval](https://junglewise.ai/threats/cve-2026-56840-praisonai-httpapproval-dashboard-renders-tool-arguments-as-raw)
- [PraisonAI unsafe tool resolution in ToolExecutionMixin](https://junglewise.ai/threats/cve-2026-44339-praisonai-unsafe-tool-resolution-in-toolexecutionmixin)
- [MervinPraison PraisonAI path traversal and RCE in MCP server](https://junglewise.ai/threats/cve-2026-44336-mervinpraison-praisonai-path-traversal-and-rce-in-mcp-server)
- [PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, 's fix gated tools.py auto-import behi](https://junglewise.ai/threats/cve-2026-44334-mervinpraison-praisonai-unauthenticated-rce-in-tool-override-py)
- [PraisonAI has an incomplete fix for - OS Command Injection](https://junglewise.ai/threats/cve-2026-41497-praisonai-has-an-incomplete-fix-for-os-command-injection)