Skip to content
Threat Feed

Tag

Cve-2026-40313

1 brief RSS
critical advisory

PraisonAI GitHub Actions Credential Leakage Vulnerability (CVE-2026-40313)

PraisonAI versions 4.5.139 and below are vulnerable to credential leakage due to the ArtiPACKED attack, where GitHub Actions workflows using actions/checkout without persist-credentials: false write the GITHUB_TOKEN into the .git/config file, leading to potential exposure in uploaded artifacts and subsequent supply chain compromise.

credential-leakage supply-chain github-actions cve-2026-40313
2r 2t 1c