Network-AI EUVD-2026-46018

The attacker must have low-privileged ability to call AgentRuntime.readFile() or AgentRuntime.listDir() on the target instance - this is the PR:L prerequisite from the CVSS vector and represents access as a configured agent or internal API user. Exploitation requires that a sibling directory exists (or can be created) on the host filesystem whose absolute path begins with the same string as the configured basePath but is not a true subdirectory of it (e.g., basePath /tmp/sandbox and sibling /tmp/sandbox_evil). The vulnerability is entirely path-layout-dependent: if no such sibling directory exists and the attacker cannot create one, no out-of-sandbox path passes the flawed check. When autoApproveReads is enabled in the AgentRuntime configuration, reads proceed without any additional approval step, making exploitation silent. Exploitation is limited to the local execution environment (AV:L) - remote-only access without the ability to invoke AgentRuntime API methods is insufficient. There is no write or delete capability exposed through this flaw; impact is confidentiality-only.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N yields a base score of 6.5 (Medium), which accurately reflects the real-world risk profile. The local attack vector (AV:L) is the primary limiting factor: the attacker must already have the ability to invoke AgentRuntime methods, implying at minimum process-level or API-level access. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning once access is established, exploitation is trivial and automatable - the PoC demonstrates this with a simple script. The scope change (S:C) with high confidentiality impact (C:H) reflects that the sandbox security boundary is fully bypassed, potentially exposing any file readable by the Node.js process on the host. There is no integrity or availability impact (I:N/A:N), as the vulnerability is read-only. EPSS data was not provided; given the niche deployment footprint and local-access prerequisite, opportunistic mass exploitation is unlikely. The public PoC elevates risk for targeted scenarios - any environment where untrusted agents or users can reach the AgentRuntime API should treat this as a high-priority patch.

An agent operating within a Network-AI deployment where basePath is configured to /srv/app-sandbox calls AgentRuntime.readFile('/srv/app-sandbox_config/database.env'). The unpatched startsWith('/srv/app-sandbox') check returns true because the target path begins with the basePath string, despite resolving entirely outside the intended sandbox. If autoApproveReads is enabled, the file contents are returned to the agent without any approval prompt or audit event. A working proof-of-concept demonstrating this exact technique is publicly available in GHSA-jvcm-f35g-w78p.