CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Attackers can use path traversal in backup IDs to copy arbitrary directories into environment data, requiring an upgrade to Network-AI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58413?
CVE-2026-58413 is a medium-severity path traversal vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment.
Which versions are affected by CVE-2026-58413?
2 open source packages ship an affected version, including network-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
network-ai npm | All versions | 5.12.2 |
network-ai npm | All versions | 5.12.2 |
Products include Network-Ai Network-Ai.
How do I fix CVE-2026-58413?
Upgrade network-ai to 5.12.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58413 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58413 exists.
Other vulnerabilities in Jovancoding Network-AI
- CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
- CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
- CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
- CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Sources
Also known as GHSA-48x2-6pr9-2jjf.