EUVD-2026-46016Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local write access to the environment data directory required (AV:L/PR:L); confidentiality-only impact as backup copies but never modifies or deletes external files.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup() recursively collects files using _collectBackupFiles(). _collectBackupFiles() uses statSync(full), which follows symlinks. If data/<env> contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into data/<env>/.backups/<backupId>/. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. _collectBackupFiles() now uses lstatSync instead of statSync and skips any entry where isSymbolicLink() is true. Symlinks are never traversed, so backup() can no longer follow a link out of the environment root and copy external files into a backup artifact.
AnalysisAI
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) arising from Node.js's distinction between statSync() and lstatSync(). In _collectBackupFiles() (lib/env-manager.ts:596-617), the code called statSync(full) which resolves symlinks before returning stat metadata - causing a symlinked directory to appear as a regular directory and be recursed into. lstatSync(), by contrast, stats the link entry itself, enabling isSymbolicLink() detection. The backup copy loop (lib/env-manager.ts:435-460) then writes all collected file paths - including those resolved through the symlink - into data/<env>/.backups/<backupId>/. The fix in commit a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3 replaces statSync with lstatSync and skips any entry where isSymbolicLink() is true. The vulnerability is reachable via the default CLI command network-ai env backup create --env <env> (bin/cli.ts:413-420) and also automatically during promote and restore operations (lib/env-manager.ts:294-297 and 483-484), broadening the trigger surface beyond explicit backup calls.
RemediationAI
Upgrade to Network-AI v5.12.2, available as a tagged GitHub release at https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2 and via npm. The patch (commit a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3) replaces statSync with lstatSync in _collectBackupFiles() and adds explicit symlink skipping via isSymbolicLink(), preventing backup traversal outside the environment root. If immediate upgrade is not possible, restrict OS-level filesystem write permissions on data/<env> directories to only trusted processes and service accounts - this prevents an attacker from placing the malicious symlink but does not eliminate the underlying code defect and carries the trade-off of potentially breaking legitimate multi-user workflows. Auditing existing backup artifacts under data/<env>/.backups/ for files originating outside the environment root can help detect prior exploitation. Do not rely on application-layer access controls alone, as the vulnerability operates at the filesystem syscall level.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today