CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
An attacker can delete arbitrary files by poisoning a backup manifest, leading to data loss or service disruption in Network-AI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58484?
CVE-2026-58484 is a high-severity path traversal vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `"path": "/"`) is now inert.
Which versions are affected by CVE-2026-58484?
2 open source packages ship an affected version, including network-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
network-ai npm | All versions | 5.12.2 |
network-ai npm | All versions | 5.12.2 |
Products include Network-Ai Network-Ai.
How do I fix CVE-2026-58484?
Upgrade network-ai to 5.12.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58484 exists.
Other vulnerabilities in Jovancoding Network-AI
- CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
- CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
- CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
- CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Sources
Also known as GHSA-2fmp-9rvw-hc96.