Jovancoding Network-AI path traversal in AgentRuntime sandbox

Executive brief

Network-AI is a library used to run AI agents within a restricted file system sandbox. A flaw in how the software checks file paths allows an agent or user to access files in folders that share a similar name to the sandbox, such as a folder named 'sandbox_private' when the allowed folder is 'sandbox'. This could lead to the unauthorized viewing or listing of sensitive files outside the intended security boundary.

Technical details

A path traversal vulnerability exists in Network-AI's AgentRuntime due to insufficient validation in the resolvePath and isPathAllowed functions. The implementation uses a simple string startsWith() check to verify if a resolved path resides within the configured basePath. Because this check is not path-separator aware, a basePath of '/tmp/sandbox' will incorrectly validate a sibling path like '/tmp/sandbox_private/file.txt'. An attacker with local access and the ability to invoke AgentRuntime.readFile() or AgentRuntime.listDir() can exploit this to read or list files outside the intended sandbox. The issue is fixed in version 5.12.2 by implementing separator-anchored prefix checks.

Affected products

• Jovancoding network-ai <= 5.12.1

Timeline

• 2026-06-18: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in v5.12.2

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D