# CVE-2026-8735: Oinone Pamirs insecure deserialization in appConfigQuery interface

Source: https://junglewise.ai/threats/cve-2026-8735-oinone-pamirs-insecure-deserialization-in-appconfigquery-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8735 · Severity: medium · CVSS 6.3 · Published 2026-05-17

Oinone Pamirs, an AI-driven low-code development framework, contains a security flaw in how it processes data. An attacker can send a specially crafted request to the system's configuration interface to execute unauthorized commands on the server. This could allow an attacker to take complete control of the server, potentially leading to data theft or service disruption. The vulnerability exists because the system's security filters for data processing were intentionally disabled.

Technologies: [Oinone Pamirs](https://junglewise.ai/threats/technologies/pamirs). Vendors: [Oinone](https://junglewise.ai/threats/vendors/oinone).

## Quick answers

**Is CVE-2026-8735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8735 being exploited in the wild.

**How severe is CVE-2026-8735?** Medium severity, with a CVSS score of 6.3, published 17 May 2026.

**Which products and versions are affected?** Oinone Pamirs up to 7.2.0.

**Is there a fix for CVE-2026-8735?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8735 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8735?** Check whether you run Oinone Pamirs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization vulnerability exists in Oinone Pamirs up to 7.2.0 within the 'appConfigQuery' interface. The root cause is located in 'PamirsParserConfig.java', where the 'setAutoTypeSupport(true)' method is explicitly called on the Fastjson ParserConfig, disabling core security protections against arbitrary class instantiation. When the 'JsonUtils.parseMap' function processes GraphQL requests where a 'Map' type is expected but a 'String' is provided, it triggers deserialization of the input. A remote, unauthenticated attacker can exploit this by passing a malicious JSON string containing the '@type' identifier (e.g., targeting 'JdbcRowSetImpl') to trigger a JNDI connection and execute remote bytecode. While the vendor has been contacted, no official patch has been released; remediation involves disabling 'autoTypeSupport' and upgrading Fastjson to a version supporting 'SafeMode'.

## Affected products

- Oinone (Zhejiang Shushi Network Technology Co., Ltd.) Pamirs (AI Low-Code Development Framework) up to 7.2.0

## Timeline

- 2026-04-22: disclosed: Vulnerability details and PoC published on GitHub by SourByte05
- 2026-05-17: advisory: CVE-2026-8735 published via VulDB/NVD

## References

- [https://github.com/SourByte05/SourByte-Lab/issues/13](https://github.com/SourByte05/SourByte-Lab/issues/13)
- [https://vuldb.com/submit/809887](https://vuldb.com/submit/809887)
- [https://vuldb.com/vuln/364323](https://vuldb.com/vuln/364323)
- [https://vuldb.com/vuln/364323/cti](https://vuldb.com/vuln/364323/cti)

## Related threats

- [Oinone Pamirs path traversal in LocalFileClient file upload](https://junglewise.ai/threats/cve-2026-8736-oinone-pamirs-path-traversal-in-localfileclient-file-upload)
- [Oinone Pamirs SQL injection in queryListByWrapper interface](https://junglewise.ai/threats/cve-2026-8734-oinone-pamirs-sql-injection-in-querylistbywrapper-interface)
- [Oinone Pamirs remote code execution in ScriptRunner](https://junglewise.ai/threats/cve-2026-39052-oinone-pamirs-remote-code-execution-in-scriptrunner)