Network Ai
Monthly
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-privileged agent or user with access to `AgentRuntime.readFile()` or `AgentRuntime.listDir()` to read or enumerate files outside the configured `basePath` sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary directories from outside the designated backups directory into any environment data directory. All versions prior to 5.12.2 (confirmed in 5.12.1) are affected, as the backupId parameter is concatenated with path.join() without containment checks, and the restore path is reachable by default through the bundled CLI. A working proof-of-concept is publicly documented in the GHSA advisory; no CISA KEV listing was identified at time of analysis.
Authentication bypass in Network-AI versions 5.7.1 and earlier allows unauthenticated remote attackers to invoke all 22 MCP tools on the SSE server because the default secret is empty and `_isAuthorized()` returns true when no secret is configured. Despite the partial fix for CVE-2026-46701 in 5.4.5 (which restricted CORS to localhost origins), any non-browser caller - curl, SSRF, or a service exposed via a 0.0.0.0 bind - can still call privileged operations like `config_set`, `agent_spawn`, `blackboard_write`, and token management with zero credentials. No public exploit identified at time of analysis, but the GHSA advisory includes annotated source-code locations that effectively serve as a roadmap for exploitation.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-privileged agent or user with access to `AgentRuntime.readFile()` or `AgentRuntime.listDir()` to read or enumerate files outside the configured `basePath` sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary directories from outside the designated backups directory into any environment data directory. All versions prior to 5.12.2 (confirmed in 5.12.1) are affected, as the backupId parameter is concatenated with path.join() without containment checks, and the restore path is reachable by default through the bundled CLI. A working proof-of-concept is publicly documented in the GHSA advisory; no CISA KEV listing was identified at time of analysis.
Authentication bypass in Network-AI versions 5.7.1 and earlier allows unauthenticated remote attackers to invoke all 22 MCP tools on the SSE server because the default secret is empty and `_isAuthorized()` returns true when no secret is configured. Despite the partial fix for CVE-2026-46701 in 5.4.5 (which restricted CORS to localhost origins), any non-browser caller - curl, SSRF, or a service exposed via a 0.0.0.0 bind - can still call privileged operations like `config_set`, `agent_spawn`, `blackboard_write`, and token management with zero credentials. No public exploit identified at time of analysis, but the GHSA advisory includes annotated source-code locations that effectively serve as a roadmap for exploitation.