CVE-2026-58481

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58481", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-30T20:21:25.811Z", "datePublished": "2026-07-20T16:30:15.220Z", "dateUpdated": "2026-07-20T17:42:43.376Z"}, "containers": {"cna": {"title": "Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-23", "lang": "en", "description": "CWE-23: Relative Path Traversal", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p"}, {"name": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3", "tags": ["x_refsource_MISC"], "url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3"}, {"name": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"}], "affected": [{"vendor": "Jovancoding", "product": "Network-AI", "versions": [{"version": "< 5.12.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:30:15.220Z"}, "descriptions": [{"lang": "en", "value": "Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope."}], "source": {"advisory": "GHSA-jvcm-f35g-w78p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T17:42:14.900798Z", "id": "CVE-2026-58481", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T17:42:43.376Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58481", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T17:42:14.900798Z"}}}], "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T17:42:35.196Z"}}], "cna": {"title": "Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory", "source": {"advisory": "GHSA-jvcm-f35g-w78p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Jovancoding", "product": "Network-AI", "versions": [{"status": "affected", "version": "< 5.12.2"}]}], "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p", "name": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3", "name": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2", "name": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:30:15.220Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58481", "state": "PUBLISHED", "dateUpdated": "2026-07-20T17:42:43.376Z", "dateReserved": "2026-06-30T20:21:25.811Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T16:30:15.220Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Network-AI", "vendor": "Jovancoding", "versions": [{"status": "affected", "version": "< 5.12.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF88D260-4A40-49E0-8A7C-7F568AD9BABC", "versionEndExcluding": "5.12.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope."}, {"lang": "es", "value": "Network-AI es un orquestador multiagente de TypeScript/Node.js. Antes de la versi\u00f3n 5.12.2, AgentRuntime promete acceso a archivos con \u00e1mbito bajo un basePath de sandbox configurado, pero sus comprobaciones de contenci\u00f3n de rutas usan pruebas de prefijo de cadena sin procesar. Una base de sandbox como \u2019/tmp/network-ai-sandbox\u2019 tambi\u00e9n coincide con una ruta hermana como \u2019/tmp/network-ai-sandbox_evil/secret.txt\u2019. Un agente/usuario que puede llamar a AgentRuntime.readFile() o AgentRuntime.listDir() puede leer o listar archivos fuera del sandbox previsto cuando la ruta de destino est\u00e1 en un directorio hermano que comparte el prefijo de la ruta base. Esto rompe el l\u00edmite de sandbox documentado. El problema se ha corregido en la v5.12.2. SandboxPolicy.resolvePath() e isPathAllowed() ahora usan comprobaciones de prefijo ancladas a separadores (\u2019resolved === base || resolved.startsWith(base + path.sep)\u2019) tanto para la lista de permitidos como para la lista de bloqueados. Un directorio hermano que simplemente comparte un prefijo de nombre (p. ej., \u2019/srv/app-evil\u2019 frente a la base \u2019/srv/app\u2019) ya no se trata como dentro del \u00e1mbito."}], "id": "CVE-2026-58481", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58481", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T17:42:14.900798Z", "version": "2.0.3"}}]}, "published": "2026-07-20T17:18:15.857", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.12.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Network-AI", "source": "cna", "vendor": "Jovancoding"}, "product": "network-ai", "vendor": "jovancoding"}], "created": "2026-07-20T23:15:04.460341+00:00", "updated": "2026-07-30T19:15:04.752580+00:00", "vendors": ["jovancoding", "jovancoding$PRODUCT$network-ai"]}