Network-AI EUVD-2026-46034

Requires local write access to a manifest file at data/<env>/.backups/<name>/_manifest.json so the attacker can control its path field, and requires that pruneBackups() subsequently execute - typically via network-ai env backup prune --env <env> --keep <n> or any caller of pruneBackups(). Limiting factors: exploitation is local only (AV:L) and depends on the attacker being able to place/modify files under the target environment's .backups directory, meaning it is gated by filesystem permissions on that directory; there is no network vector and no victim UI interaction is needed, but the prune operation must be triggered (by an operator or scheduled job) for deletion to occur, and impact is bounded to paths the Network-AI process user can delete.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1) is internally consistent with the description: exploitation is local (the attacker must place or modify a file on disk), low-complexity, and requires some level of existing access (PR:L) but no victim interaction, yielding high integrity and availability impact with no confidentiality loss - matching a delete-only primitive. This is a genuine but bounded risk: it is NOT a remote or unauthenticated flaw, so it is not a mass-exploitation candidate, and no EPSS score was provided to gauge exploitation probability. It is not listed in CISA KEV and there is no evidence of active exploitation; however, a working PoC is public, lowering the bar for a local or compromised-account attacker. The practical severity hinges on who can write into data/<env>/.backups/ - if that directory is shared, world-writable, or reachable via another vulnerability, the impact escalates to destruction of arbitrary files owned by the Network-AI process user. Treat as a medium-to-high priority local privilege/impact escalation rather than an internet-facing emergency.

An attacker with write access to the environment's backup directory (e.g., a lower-privileged local user, a co-tenant, or via a separate file-write bug) drops or edits data/dev/.backups/evil/_manifest.json with "path": "/" or a path to a critical file. The next time an operator or automation runs network-ai env backup prune --env dev --keep <n> - or any code path calling pruneBackups() - Network-AI passes that path to rmSync(..., { recursive: true, force: true }) and destroys it. A working PoC confined to a temporary directory is published in the GHSA advisory, so the technique is trivially reproducible.