CLSA-2026-1774570935 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.7.0-tuxcare.1...

CLSA-2026-1773965915 TuxCare security update for js-yaml (14 CVEs)

TuxCare rebuilt js-yaml to address 14 CVEs. Fixed in 3.3.1-tuxcare.1...

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

SummaryThe AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags such as !!js/function and !!js/undefined. This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can...

EUVD-2021-9297

Malicious code in bioql PyPI...

CVE-2021-22150

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server...

Code injection

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server...

CVE-2021-22150

KVE-2021-22150 affects Elastic Kibana. A Fleet admin could upload a malicious package, which is loaded insecurely due to an older js-yaml library, enabling command execution on the Kibana server. The vulnerability stems from the insecure handling of uploaded packages and the outdated dependency. ...

PT-2023-12040 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: A security issue was found where a user with Fleet admin permissions could upload a malicious package. This package would be loaded in an insecure manner due to the use of an older version o...

Elastic Kibana Code Injection Vulnerability

Elastic Kibana is an application from the Dutch company Elastic. A free and open user interface that enables you to visualize Elasticsearch data and lets you navigate through the Elastic Stack. Elastic Kibana suffers from a security vulnerability that stems from the use of an old version of the...