Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
EnvironmentManager.restore(env, backupId) computes the backup path with join(envDir, '.backups', backupId) and only checks that this path exists. It does not resolve the result or verify that it remains under data/<env/.backups. A caller can pass a traversal backup ID such as ../../../outside/source-dir to restore files from an arbitrary directory into the target environment data directory. Confirmed in Network-AI 5.12.1. Details restore() builds backupPath directly from caller-controlled backupId: There is no resolved containment check that ensures backupPath remains under backupsDir. Default CLI reachability exists through network-ai env backup restore --env <env --backup <id. Affected source evidence: - lib/env-manager.ts:474-499 — vulnerable restore path construction and copy. - bin/cli.ts:441-458 — default CLI exposes restore with caller-controlled --backup. PoC This PoC uses only temporary directories and restores trustlevels.json from an external directory into…
Recommended action: Upgrade to 5.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
EnvironmentManager.backup() recursively collects files using collectBackupFiles(). collectBackupFiles() uses statSync(full), which follows symlinks. If data/<env contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into data/<env/.backups/<backupId/. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. Confirmed in Network-AI 5.12.1. Details backup() collects file paths and copies them into the backup directory: collectBackupFiles() follows symlinked directories because it calls statSync(), not lstatSync(): Default CLI reachability exists through network-ai env backup create --env <env. backup() also runs automatically before promotion and restore operations. Affected source evidence: - lib/env-manager.ts:435-460 — backup copy logic. - lib/env-manager.ts:596-617 — symlink-following…
Recommended action: Upgrade to 5.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
network-ai's ApprovalInbox (lib/approval-inbox.ts) is a shipped, exported, documented feature — "a web-accessible approval queue with REST API … and SSE streaming" (SECURITY.md). It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for "high-risk operations (writes, shell commands, budget spend)" (SECURITY.md). The HTTP server it exposes has no authentication of any kind and sets Access-Control-Allow-Origin: on every route, including the state-changing POST /approvals/:id/approve and /deny. As a result, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell…
Recommended action: Upgrade to 5.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call AgentRuntime.readFile() or AgentRuntime.listDir() can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. Confirmed in Network-AI 5.12.1. Severity: Medium, CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. Details The vulnerable containment check is in lib/agent-runtime.ts: startsWith() is not path-boundary-aware. If this.config.basePath is /tmp/network-ai-sandbox, then /tmp/network-ai-sandboxevil/secret.txt also starts with /tmp/network-ai-sandbox despite being outside the sandbox. The same pattern appears in SandboxPolicy.isPathAllowed() for allowed and blocked…
Recommended action: Upgrade to 5.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
EnvironmentManager.listBackups() reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups() later passes that trusted entry.path directly to rmSync(entry.path, { recursive: true, force: true }). An attacker who can place or modify a manifest inside data/<env/.backups/<name/manifest.json can cause network-ai env backup prune --env <env --keep <n or any code path invoking pruneBackups() to recursively delete an arbitrary path accessible to the Network-AI process user. Confirmed in Network-AI 5.12.1. Details listBackups() trusts manifest content from disk: pruneBackups() uses the attacker-controlled entry.path as the deletion target: Default CLI reachability exists through network-ai env backup prune --env <env --keep <n. Affected source evidence: - lib/env-manager.ts:505-523 — reads trusted backup entries from manifest.json. - lib/env-manager.ts:529-541 — recursively deletes entry.path. - bin/cli.ts:464-472 — default CLI exposes…
Recommended action: Upgrade to 5.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent sandbox gates shell commands behind an allowlist (SandboxPolicy.isCommandAllowed), which THREATMODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but ShellExecutor runs that string through /bin/sh -c. So any wildcard allow such as git , npm or node also matches git status; <anything, and a scoped command becomes arbitrary execution. Root cause Matching and execution disagree on what a command is. Lines pinned to 40e42d7 (lib/agent-runtime.ts is identical to the v5.8.5 tag). 1. isCommandAllowed matches the full string, with no tokenizing and no metacharacter check: https://github.com/Jovancoding/Network-AI/blob/40e42d7a0a966b948953b3c524cf15355d20ef5e/lib/agent-runtime.ts#L248-L260 2. globMatch compiles to . and anchors it, so git becomes ^git .$ and matches git status; id:…
Recommended action: Upgrade to 5.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Advisory / Disclosure Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives Target: Jovancoding/Network-AI (npm network-ai), latest v5.7.1 Status: the advisory ("Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret") named three flaws. The fix (5.4.5) closed the CORS flaw (Access-Control-Allow-Origin is now set only for localhost origins), but left the empty-default-secret flaw the title is about: the SSE MCP server still defaults to an empty secret, isAuthorized() still returns true when the secret is empty, and a non-loopback bind only warns. So the server still runs fully unauthenticated by default — any non-browser caller (curl, SSRF, or a 0.0.0.0 bind) can invoke all 22 MCP tools (configset, agentspawn, blackboardwrite, token) with no credentials. Class: CWE-306/CWE-862 Missing Authentication — incomplete fix. Methodology: M1 incomplete-fix audit (anchor = the 5.4.5 fix; sibling-walk on latest v5.7.1, executed).…
Recommended action: Upgrade to 5.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret | Field | Value | | ---------------- | ----- | | Repository | Jovancoding/Network-AI | | Affected version | v5.4.4 (commit c12686e181f231cf8d7bcf836a96d78f0f0877ac) | Summary The MCP SSE server defaults to an empty secret (process.env['NETWORKAIMCPSECRET'] ?? '' at bin/mcp-server.ts:89), which causes isAuthorized (lib/mcp-transport-sse.ts:254) to return true unconditionally for every request — no Authorization header is required. Simultaneously, handleRequest sets Access-Control-Allow-Origin: (lib/mcp-transport-sse.ts:272) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including configset, agentspawn, and blackboardwrite — against a default-configured localhost server. Affected Code bin/mcp-server.ts:89 — default secret resolves to empty string, enabling open…
Recommended action: Upgrade to 5.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Advisory: Missing Authentication for Critical Function in Jovancoding/Network-AI | Field | Value | |---|---| | Project | Jovancoding/Network-AI | | Repository | https://github.com/Jovancoding/Network-AI | | Affected commit | c344f2053eb0d49395988f803bf92f2a86b2a0d0 | | Affected tested version | 5.1.2 | | Vulnerability type | CWE-306: Missing Authentication for Critical Function | | Severity | High | | Authentication required | None | | Default network exposure | Bind address 0.0.0.0 | | Reporter validation date | 2026-04-21 | Summary The MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools — including reading and mutating the live orchestrator configuration, listing registered agents, dispatching…
Recommended action: Upgrade to 5.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.