CVE-2026-58481

{
  "id": "CVE-2026-58481",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T17:18:15.857",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope."
    },
    {
      "lang": "es",
      "value": "Network-AI es un orquestador multiagente de TypeScript/Node.js. Antes de la versión 5.12.2, AgentRuntime promete acceso a archivos con ámbito bajo un basePath de sandbox configurado, pero sus comprobaciones de contención de rutas usan pruebas de prefijo de cadena sin procesar. Una base de sandbox como ’/tmp/network-ai-sandbox’ también coincide con una ruta hermana como ’/tmp/network-ai-sandbox_evil/secret.txt’. Un agente/usuario que puede llamar a AgentRuntime.readFile() o AgentRuntime.listDir() puede leer o listar archivos fuera del sandbox previsto cuando la ruta de destino está en un directorio hermano que comparte el prefijo de la ruta base. Esto rompe el límite de sandbox documentado. El problema se ha corregido en la v5.12.2. SandboxPolicy.resolvePath() e isPathAllowed() ahora usan comprobaciones de prefijo ancladas a separadores (’resolved === base || resolved.startsWith(base + path.sep)’) tanto para la lista de permitidos como para la lista de bloqueados. Un directorio hermano que simplemente comparte un prefijo de nombre (p. ej., ’/srv/app-evil’ frente a la base ’/srv/app’) ya no se trata como dentro del ámbito."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Jovancoding",
          "product": "Network-AI",
          "versions": [
            {
              "version": "< 5.12.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T17:42:14.900798Z",
          "id": "CVE-2026-58481",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.12.2",
              "matchCriteriaId": "BF88D260-4A40-49E0-8A7C-7F568AD9BABC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}