Live › vulnerability › CVE-2026-120311
Network-AI versions from 5.13.4 before 5.15.5 let a crafted job id escape the FileJobStore directory via path traversal. An attacker can read or delete arbitrary .json files, which can expose credentials and grant tokens or remove configuration that weakens AuthGuardian authorization.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Teams running Network-AI between 5.13.4 and 5.15.5 where job ids can be influenced by outside input, such as an HTTP request or queue message. Deployments that only pass internally generated job ids are less exposed. Whether an attacker can reach the job id depends on how the application exposes the job API, which the sources do not describe.
No product ranges from the sources yet.
npm ls network-ai in the project that depends on it.FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob().5.15.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.
This page as .md · .json · in your agent: get_signal("CVE-2026-120311")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.