Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Network-AI Environment Manager Copies External Files into Backups

published 3 months ago

Summary

An attacker can place a malicious symlink in the environment data directory, causing backup operations to copy sensitive files outside the environment root into backup artifacts. This issue affects Network-AI 5.12.1 and earlier versions. To mitigate this risk, ensure that only authorized users have access to the environment data directory and consider disabling symlinks or restricting their use.

What to do

Update jovanrocks network-ai to version 5.12.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	jovanrocks	network-ai	< 5.12.2 Fix: upgrade to 5.12.2
–	jovancoding	network-ai	< 5.12.2

Original advisory text

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

CWE-59Link Following

Timeline

Published20 Jul 2026

Updated23 Jul 2026

First seen19 Jun 2026

Sources

GHSA-6x2m-p4xp-wg22 · OSV

Track software like this

Free during beta