{"slug": "260828-hacked-by-doing-security-checks-malicious-injections-in-json-yaml-parsing", "title": "[260828] Hacked by Doing Security Checks? Malicious Injections in JSON/YAML Parsing and Validation", "summary": "The x-cmd team released `x ajv`, a Deno-based JSON/YAML/TOML validator that sandboxes AJV with read-only access to prevent malicious injections and privilege escalation, addressing CVE-2026-39890 in PraisonAI and CVE-2020-15366 in Ajv. The tool supports stdin streaming and Schema reuse for high-performance CI batch validation, and defaults to only `--allow-read` permission, blocking network, write, process, and environment variable access.", "body_md": "# Hacked by Doing Security Checks? Malicious Injections in JSON/YAML Parsing and Validation\n\nTLDR\n\n`x ajv`\n\nuses Deno and AJV to sandbox JSON/YAML/TOML validation with read-only access, preventing malicious injections and privilege escalation. It supports stdin streaming and Schema reuse for high-performance CI batch validation.\n\nLast Sunday, I was processing external PRs for the `x-cmd/install`\n\nrepository.\n\nThe PRs modify YAML configurations, Schemas, and add a large batch of new configuration files all at once. Before merging, these external submissions must undergo a check to ensure there is no non-compliant content.\n\nThis led me to search for a tool suitable for batch configuration validation.\n\nHowever, I quickly discovered that the validation process itself poses security risks, and no suitable existing tools were available.\n\n## Configurations as Attack Vectors \n\nThis year, the AI Agent framework PraisonAI encountered an issue with YAML parsing.\n\nCVE-2026-39890 shows that its `AgentService`\n\nreads user-uploaded Agent YAML files. Once an attacker crafts a malicious YAML, the server might execute JavaScript controlled by the attacker while parsing this \"configuration file,\" ultimately granting code execution privileges on the server.\n\nIn essence, the attacker submitted a YAML file, but the server treated it as executable code.\n\nTherefore, formats like JSON, YAML, and TOML, which appear to be mere configuration files, are equally untrusted external inputs.\n\nFor repositories like `x-cmd/install`\n\n, configurations introduced by external PRs cannot be trusted blindly. Beyond checking whether files parse normally, it is necessary to verify compliance with predefined Schemas.\n\nThis is precisely why configuration validators exist.\n\n## Securing the Validator \n\nHowever, the validator itself can also become an attack vector.\n\nIn 2020, Ajv suffered from CVE-2020-15366: attackers could supply crafted JSON Schemas to execute arbitrary code during the validation process via prototype pollution.\n\nThat is to say, malicious configurations can exploit parsers, and malicious Schemas can exploit validators.\n\nIf the validator runs with full system permissions, the issue escalates beyond a simple validation failure. It might proceed to read API keys from environment variables, access the network, modify files, or spawn other processes.\n\nThus, we specifically developed the `x ajv`\n\nmodule.\n\n## Sandboxing the Validator \n\n`x ajv`\n\nis built on top of Deno + AJV and defaults to granting only `--allow-read`\n\npermission during validation.\n\nIt can read the target files and Schemas, while all other permissions are disabled by default:\n\n| Capability | `x ajv` |\n|---|---|\n| Read Files | ✓ |\n| Network Access | ✗ |\n| Write Files | ✗ |\n| Create Processes | ✗ |\n| Read Environment Variables | ✗ |\n\nEven if the underlying parser is exploited by malicious input, the attacker will not gain a process with full system privileges.\n\nOnly two final pieces remain to be implemented: **timeout** and **CPU quota**. The former limits how long a single validation run can take, while the latter caps the compute resources it can consume.\n\n## High-Performance Batch Validation \n\nIn addition to security, `x ajv`\n\nis optimized for batch validation: it supports stdin streaming input and Schema compilation reuse, making it ideal to pair with `find`\n\nfor processing large volumes of files at once and outputting TSV directly for CI scripts.\n\nIt also remains compatible with common `ajv-cli`\n\nflags, eliminating the need to prepare a `package.json`\n\n, and allows direct validation of JSON, YAML, and TOML files.\n\n## Configurations Need Verification \n\nIn the past, discussions focused heavily on code verification: testing, reviewing, and scanning for vulnerabilities after AI generated code.\n\nNow, AI is also generating and modifying configurations in bulk. Workflows, CI/CD pipelines, Agents, and toolchains are increasingly driven by JSON, YAML, TOML, and Schemas.\n\nCode requires verification, and configuration requires verification just as well; and the tools responsible for verifying them must maintain their own security boundaries.\n\nHow does your team handle YAML / JSON validation in Agent workflows? Do you have an established CI / PR validation setup running smoothly? Feel free to leave a comment and discuss.\n\nPlease indicate the source and link of this article when reprinting.\n\nHelp us make these docs great!\n\nAll X-CMD docs are generated from command help and multiple data sources. See something that's wrong or unclear? Feel free to let us know through any of these ways~", "url": "https://wpnews.pro/news/260828-hacked-by-doing-security-checks-malicious-injections-in-json-yaml-parsing", "canonical_source": "https://x-cmd.com/blog/260828/", "published_at": "2026-08-28 00:00:00+00:00", "updated_at": "2026-08-28 02:19:44.756669+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools"], "entities": ["x-cmd", "Deno", "AJV", "PraisonAI"], "alternates": {"html": "https://wpnews.pro/news/260828-hacked-by-doing-security-checks-malicious-injections-in-json-yaml-parsing", "markdown": "https://wpnews.pro/news/260828-hacked-by-doing-security-checks-malicious-injections-in-json-yaml-parsing.md", "text": "https://wpnews.pro/news/260828-hacked-by-doing-security-checks-malicious-injections-in-json-yaml-parsing.txt", "jsonld": "https://wpnews.pro/news/260828-hacked-by-doing-security-checks-malicious-injections-in-json-yaml-parsing.jsonld"}}