CVE-2026-39890 - Vulnerability Analysis

Overview

PraisonAI < 4.5.115 contains a remote code execution caused by unsafe YAML parsing with dangerous tags in AgentService.loadAgentFromFile, letting attackers execute arbitrary JavaScript via malicious YAML upload.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript code remotely, leading to full server compromise.

Mitigation

Update to version 4.5.115 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-32vr-5gcf-3pw2

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 9, 2026

🔴 CVE-2026-39890 - Critical (9.8) PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39890/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner