MediumVulnerability
GHSA-6x2m-p4xp-wg22: Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
- Identifier
- GHSA-6x2m-p4xp-wg22
- Published
- Record updated
- Affected
- network-ai <= 5.12.1
- Fixed in
- 5.12.2
- released June 18, 2026, 1 day before disclosure
Summary
Network-AI's EnvironmentManager.backup() recursively collects files with _collectBackupFiles(), which calls statSync() and therefore follows symlinks. A symlink under data/<env> pointing to a directory outside the environment root causes backup() to copy external files into data/<env>/.backups/<backupId>/, confirmed in version 5.12.1. The source reports no RCE chain.
Mitigation
Fixed in v5.12.2 (commit a59c13a): _collectBackupFiles() now uses lstatSync instead of statSync and skips any entry where isSymbolicLink() is true, so symlinks are never traversed. Install with npm install network-ai@5.12.2.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online