Executive brief
Oinone Pamirs, an AI-driven low-code development framework, contains a security flaw in how it processes data. An attacker can send a specially crafted request to the system's configuration interface to execute unauthorized commands on the server. This could allow an attacker to take complete control of the server, potentially leading to data theft or service disruption. The vulnerability exists because the system's security filters for data processing were intentionally disabled.
Technical details
A deserialization vulnerability exists in Oinone Pamirs up to 7.2.0 within the 'appConfigQuery' interface. The root cause is located in 'PamirsParserConfig.java', where the 'setAutoTypeSupport(true)' method is explicitly called on the Fastjson ParserConfig, disabling core security protections against arbitrary class instantiation. When the 'JsonUtils.parseMap' function processes GraphQL requests where a 'Map' type is expected but a 'String' is provided, it triggers deserialization of the input. A remote, unauthenticated attacker can exploit this by passing a malicious JSON string containing the '@type' identifier (e.g., targeting 'JdbcRowSetImpl') to trigger a JNDI connection and execute remote bytecode. While the vendor has been contacted, no official patch has been released; remediation involves disabling 'autoTypeSupport' and upgrading Fastjson to a version supporting 'SafeMode'.
Affected products
- Oinone (Zhejiang Shushi Network Technology Co., Ltd.) Pamirs (AI Low-Code Development Framework) up to 7.2.0
Timeline
- 2026-04-22: disclosed: Vulnerability details and PoC published on GitHub by SourByte05
- 2026-05-17: advisory: CVE-2026-8735 published via VulDB/NVD