CVE-2026-40313: PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence
PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUBTOKEN (and sometimes ACTIONSRUNTIMETOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
actions/checkoutto a version that resolves this vulnerability.Fixed in 4.5.140 - Configuration
Update all uses of actions/checkout in .github/workflows/ and .github/actions/ to set persist-credentials: false so GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) are not written to .git/config for persistence.
GitHub Actions workflows using actions/checkout persist-credentials = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40313?
CVE-2026-40313 has been classified with a high severity due to its potential for credential leakage.
How do I fix CVE-2026-40313?
To fix CVE-2026-40313, update your PraisonAI installation to version 4.5.140 or later and ensure that actions/checkout is configured to prevent credential persistence.
What versions of PraisonAI are affected by CVE-2026-40313?
CVE-2026-40313 affects all versions of PraisonAI up to and including 4.5.139.
What type of attack does CVE-2026-40313 involve?
CVE-2026-40313 involves an ArtiPACKED attack which is a method for credential leakage via improperly configured GitHub Actions workflows.
What steps can I take to secure my GitHub Actions against CVE-2026-40313?
To secure your GitHub Actions against CVE-2026-40313, ensure that you configure actions/checkout to avoid persisting credentials and regularly update to the latest software versions.