PraisonAI anfällig für Remote Code Execution über YAML Deserialisierung beim Laden von Agentendefinitionen

The vulnerability lies in the js-yaml library's handling of YAML files. praisonai fails to disable dangerous tags like !!js/function during parsing. An attacker can leverage this by crafting a malicious YAML agent definition file. Uploading this file through the API endpoint triggers the vulnerable parsing process, leading to the execution of arbitrary JavaScript code on the server. This grants the attacker complete control over the affected system, enabling them to steal sensitive data, install malware, or pivot to other systems within the network. The potential blast radius is significant, as the attacker effectively gains root access to the server hosting the praisonai instance.

Organizations utilizing praisonai for AI agent management, particularly those relying on the API for agent deployment and configuration, are at risk. This includes teams automating agent provisioning and those using shared hosting environments where agent definition files might be accessible to other users. Legacy configurations that haven't been updated to the latest security standards are also particularly vulnerable.

• python / server:

import os
import yaml

def check_yaml_vulnerability(file_path):
    try:
        with open(file_path, 'r') as f:
            yaml.safe_load(f, Loader=yaml.FullLoader) # Use safe_load
        return False  # Safe
    except yaml.YAMLError as e:
        print(f"Error loading YAML: {e}")
        return True # Potentially unsafe

# Example usage
file_to_check = '/path/to/agent_definition.yaml'
if check_yaml_vulnerability(file_to_check):
    print(f"Potential vulnerability detected in {file_to_check}")
else:
    print(f"YAML file {file_to_check} appears safe.")

• generic web:

curl -I 'http://your-praisonai-server/api/agent/upload' -H 'Content-Type: application/yaml' -d '!!js/function alert("XSS")' | grep -i 'content-type: application/yaml'

1. 2026-04-08Disclosure

   disclosure

2. 2026-04-08Patch

   patch

1. Reserviert2026-04-07
2. Veröffentlicht2026-04-08
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-16

The primary mitigation is to upgrade praisonai to version 4.5.115 or later, which includes the necessary fix to disable dangerous YAML tags. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict access to the API endpoint used for agent file uploads to trusted sources only. Implement strict input validation on YAML files, rejecting those containing suspicious tags or patterns. Consider using a Web Application Firewall (WAF) to filter out malicious YAML payloads. After upgrading, confirm the fix by attempting to upload a known malicious YAML file and verifying that it is rejected or handled safely.