Network-AI versions from 5.14.0 up to but not including 5.15.5 have a missing authentication vulnerability in the A2AServer class. This flaw allows unauthenticated attackers to perform task operations such as sending, retrieving, and canceling tasks via JSON-RPC requests without requiring a Bearer token. The vulnerability is fixed in version 5.15.5.
Network-AI versions before 5.15.5 have a path traversal vulnerability in the InputSanitizer.sanitizePath() function. This flaw allows attackers to bypass directory restrictions by using sibling-directory paths with shared string prefixes, enabling unauthorized access to files outside the intended sandbox directory.
Network-AI versions from 5.13.4 up to but not including 5.15.5 contain a relative path traversal vulnerability in the AgentVCR component. This flaw allows attackers who can control the cassette name parameter to read or write arbitrary JSON files by passing traversal sequences to the load() or save() functions. Exploitation can lead to disclosure of sensitive JSON data or overwriting critical policy files such as AuthGuardian trust-level configurations. The vulnerability is fixed in version 5.15.5.
A path traversal vulnerability exists in Jovancoding Network-AI versions 5.13.4 up to but not including 5.15.5. This flaw in the FileJobStore component allows attackers who control the job id parameter to read or delete arbitrary .json files. Exploitation can lead to disclosure of sensitive credentials and grant tokens or deletion of configuration files, potentially weakening authorization mechanisms. The issue is fixed in version 5.15.5.
Network-AI versions before 5.15.2 have an origin validation error that improperly reflects localhost Origins into Access-Control-Allow-Origin headers regardless of the server's bind interface. This allows attacker-controlled pages with a localhost Origin to read unauthenticated endpoints cross-origin when the server binds to a non-loopback address. The vulnerability is rated low severity with a CVSS score of 2.3.
Network-AI versions from 5.14.0 up to but not including 5.15.2 have a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook. The vulnerability arises because deny patterns are matched only against the first candidate field, allowing a prompt-injected agent to place malicious payloads in other fields to evade detection and potentially write web shells or execute scripts. This issue is fixed in version 5.15.2.
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `"path": "/"`) is now inert.
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret.
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope.
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact.
Network-AI versions prior to 5.9.1 contain an OS command injection vulnerability due to improper neutralization of special shell characters in the agent sandbox's command allowlist. The allowlist matches whole command strings with wildcards but executes them via a shell, allowing attackers to append arbitrary commands. This issue is fixed in version 5.9.1 by changing execution to a non-shell spawn with strict rejection of unquoted shell metacharacters. Users should upgrade to 5.9.1 or later and avoid broad wildcard allowlist entries.