CVE-2026-58414— Jovan Marinovic Network-AI 路径遍历漏洞

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

对路径名的限制不恰当(路径遍历)

Jovan Marinovic Network-AI 路径遍历漏洞

Jovan Marinovic Network-AI是Jovan Marinovic个人开发者的一个 TypeScript/Node.js 多智能体编排器，可为任何 AI 智能体堆栈添加协调、防护和治理功能。 Jovan Marinovic Network-AI 5.12.2之前版本存在安全漏洞，该漏洞源于`_collectBackupFiles()`函数使用`statSync`跟踪符号链接，可能导致攻击者在环境数据目录下放置符号链接，使备份操作将环境根目录外的文件泄露到备份文件中。

N/A

N/A