CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Attackers can read files outside the sandbox by exploiting prefix-based path checks in Network-AI, allowing unauthorized data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58481?
CVE-2026-58481 is a medium-severity path traversal vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope.
Which versions are affected by CVE-2026-58481?
2 open source packages ship an affected version, including network-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
network-ai npm | All versions | 5.12.2 |
network-ai npm | All versions | 5.12.2 |
Products include Network-Ai Network-Ai.
How do I fix CVE-2026-58481?
Upgrade network-ai to 5.12.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58481 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58481 exists.
Other vulnerabilities in Jovancoding Network-AI
- CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
- CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
- CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
- CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Sources
Also known as GHSA-jvcm-f35g-w78p.