CVE-2026-58484
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Network-AI (TypeScript/Node.js multi-agent orchestrator) before version 5.12.2, a vulnerability was found where the 'path' field in backup manifest files is trusted. An attacker can place a malicious manifest, causing arbitrary file or directory deletion during backup pruning.
Risk Assessment
The risk includes remote deletion of arbitrary files or directories accessible to the Network-AI process, potentially leading to data loss or system integrity compromise.
Recommendation
Immediately update Network-AI to version 5.12.2 or later, which includes a fix that validates paths before deletion.
Other vulnerabilities in Network-AI
See all- CVE-2026-73614High
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
- CVE-2026-54051Critical
Vulnerability in Network-AI (TypeScript/Node.js) before version 5.9.1 allows bypassing the shell command allowlist. An attacker can execute arbitrary commands by injecting special characters (e.g., `;`).
- CVE-2026-73615High
Network-AI before version 5.15.1 contains a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
- CVE-2026-58482Medium
Vulnerability in Network-AI (versions 5.0.0-5.12.1) in the ApprovalInbox component. The HTTP server lacks authentication and sets Access-Control-Allow-Origin: *, allowing anyone who can send an HTTP request (including websites in the operator's browser) to approve pending high-risk actions without human consent.
- CVE-2026-58481Medium
Vulnerability in Network-AI (versions before 5.12.2) in the file sandbox mechanism. Path checks rely on string prefix matching, allowing an agent to read files from sibling directories with similar names (e.g., /tmp/network-ai-sandbox_evil) outside the intended sandbox.
- CVE-2026-58414Medium
Vulnerability in Network-AI (versions before 5.12.2) in the environment backup function. The _collectBackupFiles() function follows symbolic links, allowing an attacker to place a symlink to an external directory and copy its contents into the backup archive.
- CVE-2026-58413Medium
Vulnerability in Network-AI (versions before 5.12.2) in the environment restore function. The restore() function does not verify that the backup path is within the allowed directory, allowing a backup ID with ../ sequences to restore files from arbitrary directories.
- CVE-2026-46701High
Network-AI before version 5.4.5 defaults to an empty MCP SSE secret, allowing any unauthenticated request to be accepted. Additionally, the CORS header permits access from any origin, enabling an attacker to remotely invoke all 22 MCP tools on a local server.
- CVE-2026-64623High
Network-AI before version 5.13.4 has an improper cryptographic signature verification vulnerability in APSAdapter. The default local verifier accepts any non-empty string as valid. An unauthenticated attacker can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain permission tokens for sensitive resources including SHELL_EXEC.
- CVE-2026-64622High
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply configured authorization to GET /approvals/ routes, allowing unauthenticated actors to access sensitive approval data including shell commands, file paths, and risk levels. Additionally, the Access-Control-Allow-Origin: * header enables cross-origin disclosure.
Original NVD description (English source)
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `"path": "/"`) is now inert.