{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/yaml-deserialization/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-39890"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["rce","yaml deserialization","praisonai"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003ePraisonAI versions 4.5.114 and earlier are susceptible to remote code execution (RCE) due to unsafe handling of YAML deserialization. The vulnerability resides in the \u003ccode\u003eAgentService.loadAgentFromFile\u003c/code\u003e method, which uses the \u003ccode\u003ejs-yaml\u003c/code\u003e library to parse YAML files without enforcing a safe schema. This allows an attacker to inject malicious YAML payloads containing JavaScript code (e.g., using the \u003ccode\u003e!!js/function\u003c/code\u003e tag) that is executed when the agent definition file is loaded. The attack vector involves uploading a crafted YAML file as an agent definition through a vulnerable API endpoint. Successful exploitation leads to arbitrary code execution on the server, potentially compromising the entire system.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a PraisonAI instance running a vulnerable version (\u0026lt;= 4.5.114).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious YAML file containing an embedded JavaScript payload using the \u003ccode\u003e!!js/function\u003c/code\u003e tag. The payload is designed to execute arbitrary commands on the server.\u003c/li\u003e\n\u003cli\u003eAttacker leverages an API endpoint that uses \u003ccode\u003eAgentService.loadAgentFromFile\u003c/code\u003e to upload the malicious YAML file as an agent definition.\u003c/li\u003e\n\u003cli\u003eThe PraisonAI server parses the uploaded YAML file using the vulnerable \u003ccode\u003ejs-yaml.load\u003c/code\u003e function, without a safe schema.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e!!js/function\u003c/code\u003e tag triggers the execution of the embedded JavaScript code.\u003c/li\u003e\n\u003cli\u003eThe attacker's payload executes arbitrary commands on the server, such as creating a file in the /tmp directory (as demonstrated in the PoC).\u003c/li\u003e\n\u003cli\u003eAttacker achieves remote code execution and can perform actions such as data theft, installing backdoors, or further lateral movement within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code on the PraisonAI server. This can lead to complete compromise of the server, including unauthorized access to sensitive data, installation of malware, and further network penetration. The vulnerability affects PraisonAI instances running version 4.5.114 and earlier, potentially impacting all users of the affected versions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade PraisonAI to a patched version that addresses CVE-2026-39890.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule \u003ccode\u003eDetect Suspicious YAML Deserialization\u003c/code\u003e to identify attempts to exploit the vulnerability based on process creation events.\u003c/li\u003e\n\u003cli\u003eModify the \u003ccode\u003eAgentService.loadAgentFromFile\u003c/code\u003e method to use \u003ccode\u003ejs-yaml\u003c/code\u003e with a safe schema such as \u003ccode\u003eJSON_SCHEMA\u003c/code\u003e as described in the advisory.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all file uploads, especially agent definition files, to prevent the injection of malicious YAML payloads.\u003c/li\u003e\n\u003cli\u003eImplement access controls for API endpoints used to upload agent definitions to restrict access to trusted users only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-02-praisonai-rce/","summary":"PraisonAI is vulnerable to remote code execution (RCE) due to insecure YAML deserialization, allowing attackers to execute arbitrary code by uploading malicious agent definition files, affecting versions 4.5.114 and earlier.","title":"PraisonAI Remote Code Execution via YAML Deserialization","url":"https://feed.craftedsignal.io/briefs/2024-01-02-praisonai-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Yaml Deserialization","version":"https://jsonfeed.org/version/1.1"}