Cyber Posture

CVE-2026-39890

CriticalRCE

Published: 08 April 2026

Published
08 April 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0056 68.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-39890 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Praison Praisonai. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of YAML inputs at the API endpoint to reject malicious payloads with dangerous tags like !!js/function, directly preventing unsafe deserialization and RCE.

prevent

Mandates timely application of vendor patches, such as upgrading to PraisonAI 4.5.115, which fixes the unsafe YAML parsing vulnerability.

prevent

Restricts untrusted file uploads at the API to safe YAML formats or types, limiting the attack surface for malicious agent definitions.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The deserialization vulnerability (CWE-502) in PraisonAI's public-facing API endpoint enables unauthenticated remote attackers to upload malicious YAML files, resulting in arbitrary JavaScript RCE, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that,…

more

when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server. This vulnerability is fixed in 4.5.115.

Deeper analysisAI

CVE-2026-39890 is a critical deserialization vulnerability (CWE-502) in PraisonAI, an open-source multi-agent teams system. Prior to version 4.5.115, the AgentService.loadAgentFromFile method parses YAML files using the js-yaml library without disabling dangerous tags like !!js/function and !!js/undefined. This flaw enables attackers to execute arbitrary JavaScript code during parsing of untrusted YAML input. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility and lack of prerequisites.

Any unauthenticated remote attacker can exploit this vulnerability by crafting a malicious YAML file containing JavaScript payloads and uploading it as an agent definition via the PraisonAI API endpoint. Successful exploitation leads to remote code execution (RCE) on the server hosting the application, potentially allowing full compromise of the environment, data exfiltration, or further lateral movement.

The vulnerability is addressed in PraisonAI version 4.5.115, where the parsing logic was updated to mitigate the dangerous YAML tags. Security practitioners should upgrade to this version or later. Official details are available in the GitHub Security Advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-32vr-5gcf-3pw2.

As PraisonAI supports multi-agent AI workflows, this RCE flaw could impact AI/ML deployments relying on dynamic agent loading from files, though no public evidence of real-world exploitation has been reported as of the CVE publication on 2026-04-08.

Details

CWE(s)

Affected Products

praison
praisonai
≤ 4.5.114

CVEs Like This One

CVE-2026-44338Same product: Praison Praisonai
CVE-2026-39889Same product: Praison Praisonai
CVE-2026-34934Same product: Praison Praisonai
CVE-2026-34952Same product: Praison Praisonai
CVE-2026-39308Same product: Praison Praisonai
CVE-2026-44334Same product: Praison Praisonai
CVE-2026-34953Same product: Praison Praisonai
CVE-2026-40315Same product: Praison Praisonai
CVE-2026-39891Same product: Praison Praisonai
CVE-2026-39888Same product: Praison Praisonai

References