CVE-2026-58481
Received Received - Intake

Path Traversal in Network-AI Multi-Agent Orchestrator

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-58481
EUVD
EUVD-2026-46018

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
network-ai network-ai to 5.12.2 (exc)
jovancoding network-ai to 5.12.2 (exc)
jovancoding network-ai 5.12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Network-AI versions before 5.12.2 allows file access outside the intended sandbox directory. The issue occurs because the sandbox checks use simple string prefix matching instead of proper path boundary checks. For example, a base path like /tmp/network-ai-sandbox incorrectly matches sibling paths like /tmp/network-ai-sandbox_evil/secret.txt, allowing unauthorized file reads or directory listings.

Detection Guidance

Check if Network-AI is running version 5.12.1 or earlier. Inspect file access logs for AgentRuntime.readFile() or AgentRuntime.listDir() calls attempting to read files outside the configured sandbox base directory. Look for paths like /tmp/network-ai-sandbox_evil/secret.txt when the base is /tmp/network-ai-sandbox.

Impact Analysis

An attacker with access to AgentRuntime.readFile() or AgentRuntime.listDir() could read sensitive files or list directories outside the sandbox. This could expose confidential data stored in sibling directories that share the base path prefix. The impact is limited to read and list operations, with no confirmed remote code execution chain.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Unauthorized file access may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade Network-AI to version 5.12.2 or later. Review and restrict access to AgentRuntime.readFile() and AgentRuntime.listDir() functions. Ensure sandbox base directories do not share prefixes with other sensitive directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart