Arbitrary recursive deletion via poisoned backup manifest in Network-AI (CVE-2026-58484)

Network-AI's `EnvironmentManager.pruneBackups()` reads backup entries from on-disk `_manifest.json` files and passes the untrusted `path` field directly to `rmSync()` with recursive and force options. An attacker who can write or modify a manifest file under the backups directory can cause the pruning operation to recursively delete any path accessible to the Network-AI process user, resulting in significant data destruction risk. Affected versions: - <= 5.12.1 We recommend updating to: 5.12.2. CVSS 7.1 · our assessment: this_week Reference: https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-2fmp-9rvw-hc96 Details: https://vuln.today/cve/CVE-2026-58484