Executive brief
PraisonAI, a framework for deploying AI agent workforces, contains vulnerabilities that could allow unauthorized access to sensitive data or system files. Attackers can exploit these flaws to read private conversation histories between AI agents or manipulate files on the underlying server. This could lead to the exposure of proprietary business logic, data theft, or a complete disruption of the AI service.
Technical details
PraisonAI (specifically the praisonaiagents package) is vulnerable to two distinct issues in its multi-agent context handling. First, a path traversal vulnerability exists in the MultiAgentMonitor component because it fails to sanitize agent IDs before using them to construct file paths. An attacker with low privileges can use '../' sequences in an agent ID to read, write, or overwrite arbitrary files on the host system. Second, the MultiAgentLedger component suffers from memory state leakage because it does not enforce unique agent IDs; if two agents share an ID, they share the same ledger instance, allowing one agent to access another's system prompts and conversation history. These issues are addressed in version 1.5.115.
Affected products
- MervinPraison PraisonAI < 1.5.115
- MervinPraison praisonaiagents <= 1.5.114
Timeline
- 2026-04-07: advisory: Original GHSA-766v-q9x3-g744 published by vendor
- 2026-06-18: disclosed: CVE-2026-56078 published to NVD
- 2026-06-19: advisory: Duplicate advisory GHSA-fwh2-95jw-g4j6 published and withdrawn