4431 matches found
CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/tokenclusterId.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers...
Incorrect Authorization
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Incorrect Authorization via the submitjob process. An attacker can execute arbitrary OS commands on the server by submitting a crafted YAML...
Incorrect Authorization
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...
Arbitrary Argument Injection
Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the YAML unmarshalling process of the io.docker.server.metadata OCI image label into the catalog.Server struct. An attacker can execute arbitrary code as root on the host system by crafting a malicious O...
GHSA-R2XF-7JW5-PJG6 Docker MCP Gateway: Argument injection via OCI image label YAML
Summary A maliciously crafted OCI image label can inject arbitrary arguments into the docker run command line constructed by the MCP Gateway. An attacker who controls an image that the victim references via docker://, or that the victim's catalog pulls a snapshot from, can mount the host...
Arbitrary Argument Injection
Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the YAML unmarshalling process of the io.docker.server.metadata OCI image label into the catalog.Server struct. An attacker can execute arbitrary code as root on the host system by crafting a malicious O...
Docker MCP Gateway: Argument injection via OCI image label YAML
Summary A maliciously crafted OCI image label can inject arbitrary arguments into the docker run command line constructed by the MCP Gateway. An attacker who controls an image that the victim references via docker://, or that the victim's catalog pulls a snapshot from, can mount the host...
js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...
GHSA-H67P-54HQ-RP68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Summary A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relative...
02.aula (1.0.0), 0xrtest (1.0.0) +10460 more potentially affected by CVE-2026-53550 via js-yaml (>=4.0.0, <=4.1.1)
js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-53550 Source advisory: SNYK:JS-JSYAML-17342520...
Inefficient Algorithmic Complexity
Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the storeMappingPair function in loader.js when handling repeated aliases in merge sequences. An attacker can exhaust CPU...
Inefficient Algorithmic Complexity
Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the storeMappingPair function in loader.js when handling repeated aliases in merge sequences. An attacker can exhaust CPU resources and...
02.aula (1.0.0), 0xrtest (1.0.0) +10460 more potentially affected by CVE-2026-53550 via js-yaml (>=4.0.0, <=4.1.1)
js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-53550 Source advisory: OSV:GHSA-H67P-54HQ-RP68...
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Summary A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relative...
NPM: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
NPM: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases vulnerability discovered by ? in WordPress Npm js-yaml versions = 4.1.1...
02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21413 more potentially affected by CVE-2026-53550 via js-yaml (>=3.0.0, <=3.14.2)
js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-53550 Source advisory: OSV:GHSA-H67P-54HQ-RP68...
PT-2026-49573
Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.2.0 Description A crafted YAML document can trigger algorithmic CPU exhaustion during merge-key processing by repeating the same alias multiple times in a merge sequence. This results in quadratic parse-time behavio...
openSUSE 16 Security Update : perl-YAML-Syck (openSUSE-SU-2026:20938-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20938-1 advisory. Changes in perl-YAML-Syck: - CVE-2026-5089: prevent buffer underflow in base60 sexagesimal parsing PR 133 bsc1265155. Tenable has extracted the precedin...
