Cloudanix VulnDB

GHSA-766v-q9x3-g744

Medium · 6.5

PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

CVSS

6.5

EPSS

—

Published

Apr 8, 2026

CISA due date

—

The record

The `MultiAgentLedger` and `MultiAgentMonitor` components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically: 1. **Memory State Leakage via Agent ID Collision**: The `MultiAgentLedger` uses a dictionary to store ledgers by agent ID without enforcing uniqueness. This allows agents with the same ID to share ledger instances, leading to potential leakage of sensitive context data. 2. **Path Traversal in MultiAgentMonitor**: The `MultiAgentMonitor` constructs file paths by concatenating the `base_path` and agent ID without sanitization. This allows an attacker to escape the intended directory using path traversal sequences (e.g., `../`), potentially leading to arbitrary file read/write.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities