GitHub Security Advisory: GHSA-766v-q9x3-g744
Package: praisonaiagents (PIP)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: <= 1.5.114
Patched in: 1.5.115

Summary: PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

Details:
## Summary
The `MultiAgentLedger` and `MultiAgentMonitor` components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically:
1. **Memory State Leakage via Agent ID Collision**: The `MultiAgentLedger` uses a dictionary to store ledgers by agent ID without enforcing uniqueness. This allows agents with the same ID to share ledger instances, leading to potential leakage of sensitive context data.
2. **Path Traversal in MultiAgentMonitor**: The `MultiAgentMonitor` constructs file paths by concatenating the `base_path` and agent ID without sanitization. This allows an attacker to escape the intended directory using path traversal sequences (e.g., `../`), potentially leading to arbitrary file read/write.

## Details
### Vulnerability 1: Memory State Leakage
- **File**: `examples/context/12_multi_agent_context.py:68`
- **Description**: The `MultiAgentLedger` class uses a dictionary (`self.ledgers`) to store ledger instances keyed by agent ID. The `get_agent_ledger` method creates a new ledger only if the agent ID is not present. If two agents are registered with the same ID, they will share the same ledger instance. This violates the isolation policy and can lead to leakage of sensitive context data (system prompts, conversation history) between agents.
- **Exploitability**: An attacker can register an agent with the same ID as a victim agent to gain access to their ledger. This is particularly dangerous in multi-tenant systems where agents may handle sensitive user data.

### Vulnerability 2: Path Traversal
- **File**: `examples/context/12_multi_agent_context.py:106`
- **Description**: The `MultiAgentMonitor` class constructs file paths for agent monitors by directly concatenating the `base_path` and agent ID. Since the agent ID is not sanitized, an attacker can provide an ID containing path traversal sequences (e.g., `../../malicious`). This can result in files being created or read outside the intended directory (`base_path`).
- **Exploitability**: An attacker can create an agent with a malicious ID (e.g., `../../etc/passwd`) to write or read arbitrary files on the system, potentially leading to information disclosure or file corruption.

## PoC
### Memory State Leakage
```python
multi_ledger = MultiAgentLedger()

# Victim agent (user1) registers and tracks sensitive data
victim_ledger = multi_ledger.get_agent_ledger('user1_agent')
victim_ledger.track_system_prompt("Sensitive system prompt")
victim_ledger.track_history([{"role": "user", "content": "Secret data"}])

# Attacker registers with the same ID
attacker_ledger = multi_ledger.get_agent_ledger('user1_agent')

# Attacker now has access to victim's ledger
print(attacker_ledger.get_ledger().system_prompt)  # Outputs: "Sensitive system prompt"
print(attacker_ledger.get_ledger().history)        # Outputs: [{'role': 'user', 'content': 'Secret data'}]
```

### Path Traversal
```python
with tempfile.TemporaryDirectory() as tmpdir:
    mu