Vulnerability Description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Network-Ai | Network-Ai | < 5.12.2 |
Related Weaknesses (CWE)
References
- https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92Patch
- https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2PatchRelease Notes
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-48x2-6pr9-2jjExploitPatchVendor Advisory
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-48x2-6pr9-2jjExploitPatchVendor Advisory
FAQ
What is CVE-2026-58413?
CVE-2026-58413 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and...
How severe is CVE-2026-58413?
CVE-2026-58413 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58413?
Check the references section above for vendor advisories and patch information. Affected products include: Network-Ai Network-Ai.