Live › vulnerability › CVE-2026-120312
Network-AI versions from 5.13.4 before 5.15.5 let anyone who controls the cassette name in AgentVCR pass traversal sequences to load() or save(). An attacker can read sensitive JSON files or overwrite policy files such as the AuthGuardian trust-level configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Teams running Network-AI from 5.13.4 up to but not including 5.15.5 that use AgentVCR with cassette names an attacker or untrusted agent can influence. Systems that only use fixed, server-chosen cassette names or that do not use AgentVCR are not exposed. unknown whether other components are affected.
No product ranges from the sources yet.
5.15.5 (for example npm ls network-ai in the project).5.15.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-120312")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.