Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-58481 · Microsoft / collected KEV context

GHSA-jvcm-f35g-w78p

cve-program · CVE-2026-58481

• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p
• https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3
• https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2

nvd · CVE-2026-58481

• https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3
• https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2
• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p

osv · GHSA-jvcm-f35g-w78p

• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-jvcm-f35g-w78p
• https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3
• https://github.com/Jovancoding/Network-AI
• https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2

No related operational record is retained in the current change model.