AIKIDO-2026-10386
laravel/ai is vulnerable to Information Disclosure
61
Medium Risk
This Affects:
laravel/aiTL;DR
The RemembersConversations::forUser() method updates only conversationUser and does not reset conversationId. When the same agent instance is reused across multiple users (e.g. in a multi-tenant or request-scoped setup), the second user continues the first user's conversation, allowing access to private conversation history. The fix resets conversationId to null in forUser() so each user gets a new conversation context.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
laravel/ai is vulnerable to Information Disclosure in versions 0.1.0 - 0.2.8.
How to fix this
Upgrade the laravel/ai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant