Tag
js-yaml Denial of Service via Exponential Parsing Time in Flow Collections
1 TTPA denial of service vulnerability exists in the js-yaml library (versions 5.0.0 through 5.2.1) due to an exponential parsing time bug in flow collections, allowing attackers to craft a small YAML document which, when processed by `load()` or `loadAll()` functions, consumes significant CPU resources and blocks the Node.js event loop.
CVE-2026-59869: js-yaml Vulnerability Leading to Quadratic CPU Consumption and DoS
2 TTPs 1 CVEA vulnerability, CVE-2026-59869, in the `js-yaml` library allows attackers to craft malicious YAML merge-key chains, which can lead to quadratic CPU consumption and a Denial of Service condition in applications processing the input.
PraisonAI Remote Code Execution via Malicious Workflow YAML
2 rules 1 TTP 2 IOCsPraisonAI is vulnerable to remote code execution; loading untrusted YAML files with `type: job` can lead to arbitrary host command execution, potentially enabling full system compromise.
PraisonAI Remote Code Execution via Malicious Workflow YAML
2 rules 1 TTP 2 IOCsPraisonAI is vulnerable to remote code execution; loading untrusted YAML files with `type: job` can lead to arbitrary host command execution, potentially enabling full system compromise.
PraisonAI Workflow Engine Vulnerability CVE-2026-40288
2 rules 1 TTP 1 CVEPraisonAI versions before 4.5.139 and praisonaiagents versions before 1.5.140 are vulnerable to arbitrary command execution via untrusted YAML files processed by the workflow engine.