CVE-2026-39890 — PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading

Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server. This vulnerability is fixed in 4.5.115.

GHSA-32vr-5gcf-3pw2 — PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

Affected: PyPI: praisonai

## Summary The `AgentService.loadAgentFromFile` method uses the `js-yaml` library to parse YAML files without disabling dangerous tags (such as `!!js/function` and `!!js/undefined`). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server.

## Details The vulnerability exists in the YAML deserialization process. The `js-yaml` library's `load` function is used without specifying a safe schema (e.g., `JSON_SCHEMA` or `DEFAULT_SAFE_SCHEMA`). This enables the parsing of JavaScript functions and other dangerous types. When a malicious YAML file containing a `!!js/function` tag is parsed, the function is evaluated, leading to arbitrary code execution.

The vulnerable code is located in `src/agents/agent.service.ts` at line 55.

## PoC An attacker can create a malicious agent YAML file with the following content: ```yaml !!js/function > function(){ require('child_process').execSync('touch /tmp/pwned') } ``` Then, upload this file as an agent definition via the API endpoint that uses `AgentService.loadAgentFromFile`. When the agent is loaded (either during startup or via an API call that triggers loading), the payload will execute the command `touch /tmp/pwned`, demonstrating arbitrary code execution.

## Impact This vulnerability allows an unauthenticated attacker…

Most recent entries from all

CVE-2026-39890 — PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading

GHSA-32vr-5gcf-3pw2 — PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading