Unsafe Deserialization in praisonai (CVE-2026-39890)
Summary
Vulnerability in praisonai (CVE-2026-39890). Successful exploitation can lead to full system takeover. Exploitable via AgentService.loadAgentFromFile. Mitigation: upgrade to 4.5.115 or later.
Original description
The description as published by the source.
Summary
The AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server.
Details
The vulnerability exists in the YAML deserialization process. The js-yaml library's load function is used without specifying a safe schema (e.g., JSON_SCHEMA or DEFAULT_SAFE_SCHEMA). This enables the parsing of JavaScript functions and other dangerous types. When a malicious YAML file containing a !!js/function tag is parsed, the function is evaluated, leading to arbitrary code execution.
The vulnerable code is located in src/agents/agent.service.ts at line 55.
PoC
An attacker can create a malicious agent YAML file with the following content:
!!js/function >
function(){ require('child_process').execSync('touch /tmp/pwned') }
Then, upload this file as an agent definition via the API endpoint that uses AgentService.loadAgentFromFile. When the agent is loaded (either during startup or via an API call that triggers loading), the payload will execute the command touch /tmp/pwned, demonstrating arbitrary code execution.
Impact
This vulnerability allows an unauthenticated attacker (…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-39890 has been found in praisonai.
Attackers can target a specific entry point like AgentService.loadAgentFromFile over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 9.8/10.
What to do: upgrade praisonai to 4.5.115 or later.
If unsure, ask your IT team or search "praisonai CVE-2026-39890" on the vendor's site.
CVE-2026-39890 (praisonai) — CWE-502 / CVSS v3 9.8
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: AgentService.loadAgentFromFile / load / JSON_SCHEMA / DEFAULT_SAFE_SCHEMA
Patched: 4.5.115 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Unsafe deserialization (CWE-502) exists in praisonai. Attackers reach the vulnerable code path via AgentService.loadAgentFromFile without authentication.
Check the vendor advisory for the affected versions of praisonai. Attack surface: AgentService.loadAgentFromFile / load / JSON_SCHEMA / DEFAULT_SAFE_SCHEMA.
Severity: Critical (CVSS 9.8/10). Successful exploitation can lead to full system takeover.
Update to 4.5.115.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'praisonai' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'praisonai' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
praisonaiを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade praisonai to 4.5.115ステージング環境で 4.5.115 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com