Is CVE-2026-120313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120313 being exploited in the wild.

How severe is CVE-2026-120313?

High severity, with a CVSS score of 7.5, published 2 November 2026.

Which products and versions are affected?

Jovancoding Network-AI before 5.15.5.

Is there a fix for CVE-2026-120313?

Yes: fixed in 5.15.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120313 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120313?

Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120313: Network-AI path traversal in InputSanitizer.sanitizePath

CVE-2026-120313 · Severity: high · CVSS 7.5 · Published 2026-11-02

Network-AI is a library that applications use to validate file paths for secure operations within a restricted directory sandbox. A flaw in its path validation function allows attackers to read, list, or write files outside the intended sandbox by supplying paths to sibling directories with names that share a prefix with the base directory name. This can expose sensitive files or allow unauthorized file creation.

Technologies: Jovancoding Network-AI. Vendors: Jovancoding.

Quick answers

Is CVE-2026-120313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120313 being exploited in the wild.
How severe is CVE-2026-120313?: High severity, with a CVSS score of 7.5, published 2 November 2026.
Which products and versions are affected?: Jovancoding Network-AI before 5.15.5.
Is there a fix for CVE-2026-120313?: Yes: fixed in 5.15.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120313 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120313?: Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.15.5

Technical details

InputSanitizer.sanitizePath() uses a bare string prefix check (startsWith) without path-separator anchoring, allowing sibling paths like /data/project-evil to bypass validation against base /data/project. An attacker who controls the input path argument can supply absolute paths or relative traversals that resolve to out-of-scope siblings and are returned as validated, enabling read, write, and directory-listing operations outside the sandbox boundary.

Affected products

Jovancoding Network-AI before 5.15.5

Timeline

2026-10-17: disclosed
2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.