Executive brief
Network-AI is a multi-agent coordination framework that manages environment data and backups. The EnvironmentManager.restore() function improperly validates backup identifiers, allowing an authenticated user to traverse the filesystem and copy arbitrary directories from outside the backup location into the environment data directory. This can expose sensitive files, overwrite configuration files, or break environment isolation.
Technical details
The vulnerability is a path traversal issue (CWE-22, CWE-23) in the EnvironmentManager.restore(env, backupId) method. The function constructs a backup path by joining the environment backups directory with a caller-controlled backupId parameter without resolving or validating path containment: const backupPath = join(backupsDir, backupId). An attacker can supply backupId values like ../../../outside/secret-src to escape the intended .backups directory and copy files from arbitrary locations readable by the process. The restore method then iterates over collected files and copies them into the environment data directory using copyFileSync(). This requires local or authenticated network access (via the CLI: network-ai env backup restore --env <env> --backup <id>) and local filesystem read permissions on the source. The fix (v5.12.2, commit a59c13a) validates backupId against /^[\w\-]+$/ and asserts that the resolved path remains under the backups directory, rejecting any traversal attempts.
Affected products
- Jovancoding Network-AI <= 5.12.1
Timeline
- 2026-06-19: disclosed: GHSA-48x2-6pr9-2jjf published
- 2026-06-18: patched: Fixed in v5.12.2 (commit a59c13a)