Summary The AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server.

Details The vulnerability exists in the YAML deserialization process. The js-yaml library's load function is used without specifying a safe schema (e.g., JSONSCHEMA or DEFAULTSAFESCHEMA). This enables the parsing of JavaScript functions and other dangerous types. When a malicious YAML file containing a !!js/function tag is parsed, the function is evaluated, leading to arbitrary code execution.

The vulnerable code is located in src/agents/agent.service.ts at line 55.

PoC An attacker can create a malicious agent YAML file with the following content: yaml !!js/function > function(){ require('childprocess').execSync('touch /tmp/pwned') } Then, upload this file as an agent definition via the API endpoint that uses AgentService.loadAgentFromFile. When the agent is loaded (either during startup or via an API call that triggers loading), the payload will execute the command touch /tmp/pwned, demonstrating arbitrary code execution.

Impact This vulnerability allows an unauthenticated attacker (if the API endpoint is unprotected) or an authenticated attacker with the ability to upload agent definitions to execute arbitrary code on the server. This can lead to complete compromise of the server, data theft, or further network penetration.

Recommended Fix Replace the unsafe load method with a safe alternative. Specifically, use the load method with a safe schema, such as JSONSCHEMA or DEFAULTSAFESCHEMA. For example:

typescript import yaml from 'js-yaml'; import { JSONSCHEMA } from 'js-yaml';

// In the loadAgentFromFile method const agent = yaml.load(fileContent, { schema: JSONSCHEMA });

Alternatively, if the application requires only a subset of YAML features, consider using the safeLoad method from an older version (though note it was deprecated). The key is to avoid loading tags that can execute code.

Additionally, validate and sanitize all user input, especially file uploads. Ensure that agent definition files are only uploaded by trusted users and consider storing them in a secure location with proper access controls.

Summary Direct insertion of unescaped user input into template-rendering tools allows arbitrary code execution via specially crafted agent instructions. Details The createagentcentrictools() function returns tools (like acpcreatefile) that process file content using template rendering. When user input from agent.start() is passed directly into these tools without escaping (as shown in agentcentricexample.py:85-86), template expressions in the input are executed rather than treated as literal text. This occurs because: 1. No input sanitization or escaping is applied to user-controlled content 2. The ACP-enabled runtime auto-approves operations (approvalmode="auto") 3. Tools lack context-aware escaping for template syntax PoC python Replace the agent.start() call at line 85 with: result = agent.start('Create file with content: {{ self.init.globals.builtins.import("os").system("touch /tmp/pwned") }}') Successful exploitation creates /tmp/pwned confirming arbitrary command execution. The expression {{77}} renders as 49 instead of literal text. Impact Attackers can execute arbitrary system commands with the privileges of the running process by injecting malicious template expressions through agent instructions. This compromises the host system, enabling data theft, ransomware deployment, or lateral movement. Recommended Fix 1. Input Sanitization: Implement strict whitelist validation for file content 2. Contextual Escaping: Auto-escape template syntax characters (e.g., {{ }}) in user input using Jinja2 autoescape=True 3. Sandboxing: Restrict template execution environments using secure eval modes 4. Approval Hardening: Require manual approval for file creation operations in production

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The createa2uroutes() function registers the following endpoints with NO authentication checks: /a2u/info, /a2u/subscribe, /a2u/events/{streamname}, /a2u/events/sub/{id}, and /a2u/health. This vulnerability is fixed in 4.5.115.