CVE-2026-58413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58413
Aliases
Published
2026-07-20T16:26:07.531Z
Modified
2026-07-23T03:56:38.133868336Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Details

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restore(env, backupId) computes the backup path with join(envDir, '.backups', backupId) and only checks that this path exists. It does not resolve the result or verify that it remains under data/<env>/.backups. A caller can pass a traversal backup ID such as ../../../outside/source-dir to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. restore() now validates backupId against /^[\w\-]+$/ and asserts dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir) before touching the filesystem. Backup IDs containing path separators or .. are rejected, so a crafted ID can no longer copy directories from outside .backups/ into the environment.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58413.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-23"
    ]
}
References

Affected packages

Git / github.com/jovancoding/network-ai

Affected ranges

Type
GIT
Repo
https://github.com/jovancoding/network-ai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.12.2"
        }
    ]
}

Affected versions

Other
V1
v2.*
v2.0.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.2
v3.1.3
v3.2.0
v3.2.1
v3.2.10
v3.2.11
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v3.4.0
v3.4.1
v3.5.0
v3.5.1
v3.6.0
v3.6.2
v3.7.0
v3.7.1
v3.8.0
v3.9.0
v4.*
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.14
v4.0.15
v4.0.16
v4.0.17
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.1.0
v4.10.0
v4.10.1
v4.10.2
v4.10.3
v4.10.4
v4.10.5
v4.11.0
v4.11.1
v4.11.2
v4.12.0
v4.12.1
v4.13.0
v4.13.1
v4.14.0
v4.15.0
v4.15.1
v4.15.2
v4.15.3
v4.2.0
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.7.1
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.10.0
v5.10.1
v5.10.2
v5.11.0
v5.12.0
v5.12.1
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v5.3.2
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.5.7
v5.5.8
v5.5.9
v5.6.0
v5.6.1
v5.7.0
v5.7.1
v5.7.2
v5.8.0
v5.8.1
v5.8.2
v5.8.3
v5.8.4
v5.8.5
v5.8.6
v5.8.7
v5.8.8
v5.8.9
v5.9.0
v5.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58413.json"