Network-AI Path Traversal and Missing Authentication

Path traversal in Network-AI through 5.15.4 lets an attacker who controls the path passed to InputSanitizer.sanitizePath() escape the intended sandbox by supplying a sibling directory whose name shares the base directory's string prefix, enabling file read or directory listing outside the base; the advisory argues write outside the base is also possible, but that primitive is not demonstrated. The flaw requires a consuming application to use this helper as its terminal path validation with attacker-influenced inputPath and a basePath set to the sandbox root, and it is limited to prefix-sharing sibling layouts because classic ../../../ traversal is still rejected. The advisory includes a public proof-of-concept reproduction script, not verified as working exploit code; no CISA KEV active-exploitation status is indicated in the supplied data, and the independent assessment scores confidentiality impact as high with no integrity or availability impact.

Path traversal in Network-AI's FileJobStore lets a low-privilege authenticated attacker who controls a job id read or delete arbitrary .json files under the process's filesystem permissions in network-ai 5.13.4 through 5.15.4. The advisory shows how traversal sequences such as ../../some-config reach readFile or unlink through FileJobStore.get(), FileJobStore.delete(), JobQueue.getJob(), or JobQueue.cancel(), exposing credentials, grant tokens, and configuration that can weaken AuthGuardian authorization; no remote code execution was demonstrated. This is a credible this-week priority when job management is exposed to untrusted requests, but active exploitation is not confirmed (not in CISA KEV) and the advisory includes a proof-of-concept script.

Path traversal in Network-AI's AgentVCR component lets a caller who controls the cassette name passed to load() or save() read arbitrary .json files or overwrite them anywhere the Node.js process has filesystem permissions. Versions 5.13.4 through 5.15.4 of the npm package network-ai are affected; 5.15.5 is the first release containing the fix. The impact is a confidentiality and integrity breach confined to paths ending in .json: an attacker can disclose secrets held in JSON configuration and, per the upstream advisory, overwrite AuthGuardian trust-level configuration to obtain a grant an operator's policy had denied, or corrupt the active-grant store to invalidate legitimate agents' tokens - no code execution path was demonstrated. Exploitation depends on the consuming application deriving cassette names from an untrusted source, requires some privilege within the orchestration (CVSS PR:L), and the upstream advisory itself publishes a reproducible proof-of-concept script demonstrating the file-read primitive; no confirmed active exploitation is reported.

Network-AI's A2AServer fails open on authentication: the `secret` option is optional with no default and `startServer()` performs no fail-closed startup check, so an instance started without a secret accepts unauthenticated JSON-RPC `tasks/send`, `tasks/get` and `tasks/cancel` calls from anyone who can reach the listener. The npm package `network-ai` is affected through version 5.15.4 (vendor fix: 5.15.5); the default 127.0.0.1 bind limits exposure, but the A2A protocol is designed for inter-agent network communication, so operators who bind a reachable interface-or attackers using a co-located/container-network process or DNS rebinding against loopback-can submit attacker-controlled task text to the developer-supplied executor, read task results and cancel tasks. Rated moderate (CVSS 6.9, CWE-306), the issue is not in CISA KEV and no confirmed active exploitation exists, though the GitHub advisory publishes a curl-based proof-of-concept reference; the downstream impact beyond task records and executor output depends entirely on what the configured executor does with the supplied text.