{"id":"CVE-2026-58414","aliases":["GHSA-6x2m-p4xp-wg22"],"url":"https://o3.security/vulnerability/CVE-2026-58414","summary":"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups","details":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact.","published":"2026-07-20T16:28:29.809Z","modified":"2026-08-15T11:46:16.609250154Z","cvss":{"score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00203,"percentile":0.10225,"asOf":"2026-09-07"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"network-ai","fixedVersion":"5.12.2"}],"fix":{"url":"https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3","label":"Jovancoding/Network-AI@a59c13a"},"references":[{"type":"WEB","url":"https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58414.json"},{"type":"ADVISORY","url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-6x2m-p4xp-wg22"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58414"},{"type":"FIX","url":"https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-15T11:46:16.609250154Z"}}