{"id":"CVE-2026-58414","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T17:18:15.720","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact."},{"lang":"es","value":"Network-AI es un orquestador multiagente de TypeScript/Node.js. Antes de la versión 5.12.2, “EnvironmentManager.backup()” recopila archivos recursivamente usando “_collectBackupFiles()”. “_collectBackupFiles()” usa “statSync(full)”, que sigue enlaces simbólicos. Si “data/[env]” contiene un enlace simbólico a un directorio fuera de la raíz del entorno, la recursión de la copia de seguridad sigue el enlace simbólico y copia archivos externos en “data/[env]/.backups/[backupId]/”. Un atacante que puede colocar un enlace simbólico bajo el directorio de datos del entorno puede hacer que las operaciones de copia de seguridad divulguen archivos fuera de la raíz del entorno en los artefactos de copia de seguridad. El problema está solucionado en la v5.12.2. “_collectBackupFiles()” ahora usa “lstatSync” en lugar de “statSync” y omite cualquier entrada donde “isSymbolicLink()” sea verdadero. Los enlaces simbólicos nunca se atraviesan, por lo que “backup()” ya no puede seguir un enlace fuera de la raíz del entorno y copiar archivos externos en un artefacto de copia de seguridad."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Jovancoding","product":"Network-AI","versions":[{"version":"< 5.12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T18:59:59.897950Z","id":"CVE-2026-58414","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*","versionEndExcluding":"5.12.2","matchCriteriaId":"BF88D260-4A40-49E0-8A7C-7F568AD9BABC"}]}]}],"references":[{"url":"https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-6x2m-p4xp-wg22","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-6x2m-p4xp-wg22","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}