CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
An attacker with write access to the environment directory can use symlinks to expose external files in backups, requiring an upgrade to Network-AI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58414?
CVE-2026-58414 is a medium-severity path traversal vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact.
Which versions are affected by CVE-2026-58414?
2 open source packages ship an affected version, including network-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
network-ai npm | All versions | 5.12.2 |
network-ai npm | All versions | 5.12.2 |
Products include Network-Ai Network-Ai.
How do I fix CVE-2026-58414?
Upgrade network-ai to 5.12.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58414 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58414 exists.
Other vulnerabilities in Jovancoding Network-AI
- CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
- CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
- CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
- CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
- CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Sources
Also known as GHSA-6x2m-p4xp-wg22.