{"id":"CVE-2026-120311","kind":"vulnerability","aliases":["CVE-2026-120311"],"related":[],"title":"Network-AI: path traversal in job store reads or deletes arbitrary JSON files","description":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.","summary":"Network-AI versions from 5.13.4 before 5.15.5 let a crafted job id escape the FileJobStore directory via path traversal. An attacker can read or delete arbitrary .json files, which can expose credentials and grant tokens or remove configuration that weakens AuthGuardian authorization.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","javascript","network-ai","node.js"],"not_affected_if":["internal-only-job-ids","versions-outside-range"],"how_to_check":"- Check the installed Network-AI version, for example with `npm ls network-ai` in the project that depends on it.\n- Look for any code path that passes user-controlled values into `FileJobStore.get()`, `FileJobStore.delete()`, or `JobQueue.getJob()`.","fix":"- Network-AI: move to `5.15.5` or later.","status":"open","published_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","triaged_at":"2026-11-02T03:31:46+00:00","updated_at":"2026-11-02T03:31:46+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-02T03:31:46Z","model":"claude-haiku-5-5","output":{"fix":"- Network-AI: move to `5.15.5` or later.","reach":"unknown","title":"Network-AI: path traversal in job store reads or deletes arbitrary JSON files","impact":"high","summary":"Network-AI versions from 5.13.4 before 5.15.5 let a crafted job id escape the FileJobStore directory via path traversal. An attacker can read or delete arbitrary .json files, which can expose credentials and grant tokens or remove configuration that weakens AuthGuardian authorization.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["network-ai","ai-agents","node.js","javascript"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads credentials or deletes config files, weakening authorization","analyst_note":"Confirm from the NVD entry or the vendor advisory whether unauthenticated input reaches the job id, and whether any default configuration exposes it.","how_to_check":"- Check the installed Network-AI version, for example with `npm ls network-ai` in the project that depends on it.\n- Look for any code path that passes user-controlled values into `FileJobStore.get()`, `FileJobStore.delete()`, or `JobQueue.getJob()`.","plain_action":"","needs_analyst":true,"not_affected_if":["internal-only-job-ids","versions-outside-range"],"who_is_affected":"Teams running Network-AI between 5.13.4 and 5.15.5 where job ids can be influenced by outside input, such as an HTTP request or queue message. Deployments that only pass internally generated job ids are less exposed. Whether an attacker can reach the job id depends on how the application exposes the job API, which the sources do not describe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4187,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120311':17A,20A '-2026':16A,19A '5.13.4':37B,79C '5.15.5':39B,81C 'agent':23B 'ai':3A,22B,25B,30B,34B,77C 'ai-ag':21B 'ai-tool':24B 'allow':90C 'arbitrari':12A,58B,96C 'attack':53B,91C,107C 'authguardian':73B,129C 'author':74B,130C 'configur':70B,125C 'contain':82C 'control':108C 'craft':42B 'credenti':64B,119C 'cve':15A,18A 'delet':11A,57B,95C,124C 'directori':48B 'disclos':118C 'escap':45B 'expos':63B 'file':14A,60B,98C,126C 'filejobstor':47B,88C 'filejobstore.delete':114C 'filejobstore.get':113C 'grant':66B,121C 'id':44B,106C,110C 'javascript':27B 'job':7A,43B,105C 'jobqueue.getjob':116C 'json':13A,59B,97C 'let':40B 'network':2A,29B,33B,76C 'network-ai':1A,28B,32B,75C 'node.js':31B 'pass':111C 'path':4A,50B,84C 'read':9A,55B,93C 'remov':69B 'sequenc':102C 'store':8A 'suppli':100C 'token':67B,122C 'tool':26B 'travers':5A,51B,85C,101C 'version':35B 'via':49B 'vulner':86C 'weaken':72B,128C","nicknames":[],"mitigations":[],"who_affected":"Teams running Network-AI between 5.13.4 and 5.15.5 where job ids can be influenced by outside input, such as an HTTP request or queue message. Deployments that only pass internally generated job ids are less exposed. Whether an attacker can reach the job id depends on how the application exposes the job API, which the sources do not describe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","high","javascript","networkai","nodejs"],"first_public_at":"2026-11-02T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120311","severity":null,"published_at":"2026-11-02T03:17:28+00:00","modified_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","fetched_at":"2026-11-02T03:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}