Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-120312: Network-AI allows attackers to read or change JSON files
CVE-2026-120312 · published 1 day ago
Summary
Versions of Network-AI from 5.13.4 up to but not including 5.15.5 let a user who can set the cassette name trick the system into accessing any .json file on the server. This could expose confidential configuration data or let an attacker overwrite policy files, affecting security settings. Update to version 5.15.5 or later, or restrict who can control cassette names, to stop the risk.
What to do
- Update jovancoding network-ai to version 5.15.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jovancoding | network-ai | < 5.15.5 |
Original advisory text
Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.
References
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj4... Vendor Advisory
- https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traver... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-1203... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-120312 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-23Relative Path Traversal
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-120312 · NVD
CVE-2026-120312 · MITRE
CVE-2026-120312 · OSV
GHSA-mfxv-jg44-xj48 · GHSA
Track software like this
Free during beta