Executive brief
Network-AI is a multi-agent coordination framework used to manage shared state and orchestrate AI agents. A vulnerability in the backup pruning feature allows an attacker with write access to the data directory to craft a malicious backup manifest that causes arbitrary recursive deletion of files and directories accessible to the Network-AI process. This results in data loss and denial of service when backups are pruned.
Technical details
The vulnerability is a path traversal flaw (CWE-22, CWE-73) in Network-AI's backup pruning mechanism. The EnvironmentManager.listBackups() function reads backup manifest files (_manifest.json) from disk without validation and trusts the 'path' field within them. The pruneBackups() function later uses this attacker-controlled path directly in rmSync(entry.path, { recursive: true, force: true }), enabling recursive deletion of arbitrary directories. An attacker with write access to data/<env>/.backups/<name>/_manifest.json can inject a malicious path (e.g., "/" or any filesystem location accessible to the Network-AI process user) to cause data destruction when the CLI command 'network-ai env backup prune --env <env> --keep <n>' is executed. The fix in v5.12.2 recomputes the deletion path from a validated backupId and enforces a dirname containment check, preventing traversal outside the backups directory.
Affected products
- Jovancoding Network-AI <=5.12.1
Timeline
- 2026-06-19: disclosed
- 2026-06-18: patched: Fixed in v5.12.2 (commit a59c13a)