Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. praisonaiagents
  4. ›
  5. GHSA-766v-q9x3-g744

GHSA-766v-q9x3-g744: PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

April 8, 2026

The MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically:

  1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent ID without enforcing uniqueness. This allows agents with the same ID to share ledger instances, leading to potential leakage of sensitive context data.
  2. Path Traversal in MultiAgentMonitor: The MultiAgentMonitor constructs file paths by concatenating the base_path and agent ID without sanitization. This allows an attacker to escape the intended directory using path traversal sequences (e.g., ../), potentially leading to arbitrary file read/write.

References

  • github.com/MervinPraison/PraisonAI
  • github.com/MervinPraison/PraisonAI/security/advisories/GHSA-766v-q9x3-g744
  • github.com/advisories/GHSA-766v-q9x3-g744

Code Behaviors & Features

Detect and mitigate GHSA-766v-q9x3-g744 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.5.115

Fixed versions

  • 1.5.115

Solution

Upgrade to version 1.5.115 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-668: Exposure of Resource to Wrong Sphere

Source file

pypi/praisonaiagents/GHSA-766v-q9x3-g744.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:19:11 +0000.