MediumVulnerability
GHSA-jvcm-f35g-w78p: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
- Identifier
- GHSA-jvcm-f35g-w78p
- Published
- Record updated
- Affected
- network-ai <= 5.12.1
- Fixed in
- 5.12.2
- released June 18, 2026, 1 day before disclosure
Summary
Network-AI's `AgentRuntime` uses raw string `startsWith()` checks for sandbox containment, so a sibling directory sharing the `basePath` prefix (for example `/tmp/network-ai-sandbox_evil` against `/tmp/network-ai-sandbox`) passes the check. An agent or user able to call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the sandbox, confirmed in version 5.12.1 with CVSS 3.1 Medium severity. Embedding applications that use `FileAccessor.write()` directly or auto-approve writes may also allow writes outside the sandbox.
Mitigation
Fixed in [v5.12.2](https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2) (commit `a59c13a`).
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online