CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
Attackers can achieve remote code execution by uploading malicious YAML agent definitions due to unsafe deserialization in PraisonAI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39890?
CVE-2026-39890 is a critical unsafe deserialization vulnerability in MervinPraison PraisonAI, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server. This vulnerability is fixed in 4.5.115.
Weakness: CWE-502
Which versions are affected by CVE-2026-39890?
3 open source packages ship an affected version, including praisonai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.5.115 |
praisonai PyPI | All versions | 4.5.115 |
praisonai PyPI | All versions | 4.5.115 |
Products include Praison Praisonai.
How do I fix CVE-2026-39890?
Upgrade praisonai to 4.5.115 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-39890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39890 exists.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
- CVE-2026-34935 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Sources
Also known as GHSA-32vr-5gcf-3pw2, PYSEC-2026-462.