EUVD-2026-46018Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local vector (AV:L) and low privileges (PR:L) required to call AgentRuntime API; sandbox boundary crossed (S:C) with high confidentiality loss (C:H); read-only flaw so I:N and A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandbox_evil/secret.txt. An agent/user that can call AgentRuntime.readFile() or AgentRuntime.listDir() can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. SandboxPolicy.resolvePath() and isPathAllowed() now use separator-anchored prefix checks (resolved === base || resolved.startsWith(base + path.sep)) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. /srv/app-evil vs base /srv/app) is no longer treated as in-scope.
AnalysisAI
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package network-ai by jovancoding) allows any low-privileged agent or user with access to AgentRuntime.readFile() or AgentRuntime.listDir() to read or enumerate files outside the configured basePath sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Network-AI is a TypeScript/Node.js multi-agent orchestrator that exposes a sandboxed file I/O API (AgentRuntime.readFile(), AgentRuntime.listDir()) intended to scope agent filesystem access to a configured basePath. The root cause is CWE-22 (Path Traversal): the containment check in lib/agent-runtime.ts at lines 393-423 uses JavaScript's String.prototype.startsWith() to test whether a resolved path falls within the sandbox. Because startsWith() is not path-separator-aware, a basePath of /tmp/network-ai-sandbox incorrectly accepts /tmp/network-ai-sandbox_evil/secret.txt as in-scope - the string prefix matches even though the path resolves to a completely separate sibling directory. The same flawed pattern is replicated in SandboxPolicy.isPathAllowed() for both the allow-list and block-list. The fix, introduced in v5.12.2 (commit a59c13a1), replaces bare startsWith(base) with separator-anchored checks: resolved === base || resolved.startsWith(base + path.sep), ensuring only true subdirectory descendants pass. The autoApproveReads configuration flag, when enabled, further removes any approval gate for read operations, making exploitation silent.
RemediationAI
Upgrade to Network-AI v5.12.2, the vendor-released patch that corrects the separator-anchored path containment logic in SandboxPolicy.resolvePath() and isPathAllowed(). The patched release is available at https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2 and the fixing commit is a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3. For deployments that cannot immediately upgrade, restrict who can invoke AgentRuntime.readFile() and AgentRuntime.listDir() to fully trusted principals only - this eliminates the PR:L attack surface. Additionally, disable autoApproveReads in the AgentRuntime configuration if it is enabled; requiring explicit approval for each read operation adds a human gate that limits silent exfiltration. Ensure the filesystem layout does not place sensitive directories adjacent to sandbox roots with similar name prefixes, as a compensating control - though this is fragile and not a substitute for patching. The advisory and full vendor disclosure are at https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today