Network-AI AgentVCR CVE-2026-120312

Exploitation requires the attacker to control the 'name' argument passed to AgentVCR.load() or AgentVCR.save(), and the consuming application must derive that cassette name from an untrusted source (test parameters, request data, or agent instructions) rather than a hardcoded constant. The primitive is bounded to paths resolving to a '.json' suffix and to the files the process itself can read or write, with no demonstrated path to code execution. Limiting factors: this is a library-level flaw, so a deployment that only ever passes fixed, trusted cassette names is not exploitable; the CVSS PR:L indicates some privilege/participation in the orchestration is needed; and impact is confined to disclosing or corrupting .json files (including forging AuthGuardian trust-level config or invalidating active-grant tokens). The vendor's suggested remediation is an identifier allowlist plus a resolved-directory containment check on both methods.

This is a genuine high-impact flaw whose real-world priority is tempered by a library-boundary dependency, so the signals must be weighed carefully. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) scores 8.7 and reflects a low-complexity attack needing only low privileges and no user interaction, yielding full read/write over JSON files and the ability to forge AuthGuardian trust-level configuration. However, these severity metrics describe the capability once an attacker controls the cassette name - they do not by themselves establish that the name is reachable from an untrusted source in a given deployment; the advisory itself notes the strongest counter-argument is that the name might be a hardcoded constant, which it rebuts only at the general library-API level, not for every consumer. No EPSS score is provided, so widespread-exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and there is no indication of active exploitation. A public proof-of-concept reproduction script is published in the GHSA advisory demonstrating the read primitive escaping the cassette directory. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious issue warranting prompt remediation rather than an active-exploitation fire drill. The most important conflict to resolve before acting: the CVE description and the VulnCheck footer state the issue is fixed in 5.15.5, while the GHSA advisory body states 'not fixed,' lists the latest checked release as 5.15.4, and says no fix for this code path has been released - verify the actual patched version with the vendor before relying on an upgrade.

In a multi-agent orchestration or testing deployment where AgentVCR cassette names are derived from test parameters, request data, or agent instructions, an attacker who can influence that name supplies a value like '../../config/trust' to AgentVCR.save(), writing attacker-chosen JSON outside the intended cassette directory. By overwriting AuthGuardian's trust-level configuration the attacker causes the orchestrator to grant privileges to an agent the operator had placed below the denial threshold, or uses load() to read sensitive .json files such as stored credentials. A public PoC reference exists in the advisory demonstrating the read primitive; it is not verified as a weaponized exploit, and no remote code execution path was demonstrated.