Skip to content
Threat Feed
Subscribe

Tag

Yaml

4 briefs RSS
medium advisory

js-yaml Denial of Service via Exponential Parsing Time in Flow Collections

A denial of service vulnerability exists in the js-yaml library (versions 5.0.0 through 5.2.1) due to an exponential parsing time bug in flow collections, allowing attackers to craft a small YAML document which, when processed by `load()` or `loadAll()` functions, consumes significant CPU resources and blocks the Node.js event loop.

js-yaml denial-of-service yaml javascript vulnerability
1t
medium threat

CVE-2026-59869: js-yaml Vulnerability Leading to Quadratic CPU Consumption and DoS

A vulnerability, CVE-2026-59869, in the `js-yaml` library allows attackers to craft malicious YAML merge-key chains, which can lead to quadratic CPU consumption and a Denial of Service condition in applications processing the input.

exploited js-yaml denial-of-service vulnerability yaml
2t 1c
critical advisory

PraisonAI Remote Code Execution via Malicious Workflow YAML

PraisonAI is vulnerable to remote code execution; loading untrusted YAML files with `type: job` can lead to arbitrary host command execution, potentially enabling full system compromise.

praisonai rce yaml
2r 1t 2i
critical advisory

PraisonAI Workflow Engine Vulnerability CVE-2026-40288

PraisonAI versions before 4.5.139 and praisonaiagents versions before 1.5.140 are vulnerable to arbitrary command execution via untrusted YAML files processed by the workflow engine.

PraisonAI +1 yaml code-execution cve-2026-40288
2r 1t 1c