Network-AI CVE-2026-120311

Requires the deploying application to expose network-ai's job lookup, cancellation, or deletion so that the id/jobId passed to FileJobStore.get(), FileJobStore.delete(), JobQueue.getJob(), or JobQueue.cancel() originates from an untrusted request - the advisory notes this is the typical configuration when job management is exposed over a network interface. The attacker must control the id value and supply relative traversal sequences (e.g. '../../some-config'); the automatically generated safe hexadecimal IDs from enqueue() do not constrain these lookup/delete entry points. Exploitation is LIMITED to filesystem paths that resolve to a '.json' suffix and to locations the process already has permission to read or unlink, and requires low-privilege authenticated access (PR:L) - it is not anonymous. Affected range is network-ai 5.13.4 onward (the vulnerable lib/job-queue.ts module is absent in 5.13.3 and earlier); no remote code execution was demonstrated.

This is a credible, prioritize-this-week issue rather than an inflated high-CVSS score, but it is bounded by a real precondition. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low privilege (PR:L), and the VulnCheck/vuln.today decision label is 'this_week' - not an emergency, but near-term. The GHSA advisory supplies a working proof-of-concept script and precise source-line root-cause analysis, so the mechanism is confirmed, not inferred. Weighing the signals: impact is genuinely high across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) because the attacker can read JSON holding credentials/grant tokens and delete JSON that weakens AuthGuardian authorization; however, exploitability hinges on a deployment that exposes job lookup/cancel over a network interface so the jobId is attacker-controlled - the advisory states this is 'typically' the case but it is a deployment-dependent condition, not universal. Key missing/conflicting data: no EPSS score and no KEV listing were provided, so there is no evidence of active exploitation - this is not confirmed in-the-wild. There is also a direct fix-version conflict (see confidence_notes) that must be resolved before planning remediation. The realistic prioritization is driven by the confirmed PoC plus high impact, tempered by the authenticated/network-exposed precondition and the obscurity of the affected package.

An authenticated low-privilege user of an application that wraps network-ai's JobQueue submits a job-status or job-cancel request whose jobId is a traversal string such as '../../config/active-grants' (resolving to a .json file). The value flows unsanitized through JobQueue.getJob()/FileJobStore.get() and path.join() normalizes the '..' segments, letting the attacker read the active-grant store (disclosing replayable grant tokens) or, via delete(), remove the trust-level configuration so AuthGuardian falls back to permissive defaults. A public proof-of-concept script is published in the GHSA advisory demonstrating the read primitive escaping the configured job directory; it is not flagged as confirmed weaponized exploit code.