CVE-2026-39890 json
PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
published 2026-04-08 7 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-20638 , GHSA-32vr-5gcf-3pw2 , PYSEC-2026-462
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server. This vulnerability is fixed in 4.5.115.
Patch / fix
- pypi praisonai 4.5.115
- praison praisonai 4.5.115
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-32vr-5gcf-3pw2 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | praisonai | <4.5.115 |
4.5.115 |
Affected products
- MervinPraison PraisonAI
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/MervinPraison/PraisonAI/security/advisories/GHSA-32vr-5gcf-3pw2
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-39890
advisory
-
github.com
/MervinPraison/PraisonAI
package
-
github.com
/MervinPraison/PraisonAI/releases/tag/v4.5.115
web
-
pypi.org
/project/praisonai
package
-
github.com
/advisories/GHSA-32vr-5gcf-3pw2
advisory
Sources
- CVE List CVE-2026-39890
- GitHub Advisory GHSA-32vr-5gcf-3pw2
- NVD CVE-2026-39890
- OSV PYSEC-2026-462
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.