{"id":"CVE-2026-120312","kind":"vulnerability","aliases":["CVE-2026-120312"],"related":[],"title":"Network-AI: path traversal in AgentVCR lets attackers read or overwrite JSON files","description":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.","summary":"Network-AI versions from 5.13.4 before 5.15.5 let anyone who controls the cassette name in AgentVCR pass traversal sequences to load() or save(). An attacker can read sensitive JSON files or overwrite policy files such as the AuthGuardian trust-level configuration.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentvcr","ai-agents","ai-tooling","network-ai","node"],"not_affected_if":["agentvcr-unused","fixed-cassette-names"],"how_to_check":"- Check the installed Network-AI version against `5.15.5` (for example `npm ls network-ai` in the project).\n- Look for calls to AgentVCR load() or save() where the cassette name comes from user input or an agent.","fix":"- Network-AI: move to `5.15.5` or later.","status":"open","published_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","triaged_at":"2026-11-02T03:31:46+00:00","updated_at":"2026-11-02T03:31:46+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-02T03:31:46Z","model":"claude-haiku-5-5","output":{"fix":"- Network-AI: move to `5.15.5` or later.","reach":"unknown","title":"Network-AI: path traversal in AgentVCR lets attackers read or overwrite JSON files","impact":"high","summary":"Network-AI versions from 5.13.4 before 5.15.5 let anyone who controls the cassette name in AgentVCR pass traversal sequences to load() or save(). An attacker can read sensitive JSON files or overwrite policy files such as the AuthGuardian trust-level configuration.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["network-ai","agentvcr","ai-agents","node"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads sensitive JSON or rewrites trust-level policy files","analyst_note":"","how_to_check":"- Check the installed Network-AI version against `5.15.5` (for example `npm ls network-ai` in the project).\n- Look for calls to AgentVCR load() or save() where the cassette name comes from user input or an agent.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-cassette-names","agentvcr-unused"],"who_is_affected":"Teams running Network-AI from 5.13.4 up to but not including 5.15.5 that use AgentVCR with cassette names an attacker or untrusted agent can influence. Systems that only use fixed, server-chosen cassette names or that do not use AgentVCR are not exposed. unknown whether other components are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4157,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120312':17A,20A '-2026':16A,19A '5.13.4':37B,79C '5.15.5':39B,81C 'agent':24B 'agentvcr':7A,21B,48B,88C 'ai':3A,23B,26B,30B,34B,77C 'ai-ag':22B 'ai-tool':25B 'allow':90C 'anyon':41B 'arbitrari':100C 'attack':9A,57B,91C,103C 'authguardian':70B,123C 'cassett':45B,94C 'configur':74B,127C 'contain':82C 'control':43B,92C 'cve':15A,18A 'data':116C 'disclos':113C 'file':14A,62B,66B,102C,120C 'json':13A,61B,101C,115C 'let':8A,40B 'level':73B,126C 'load':53B,109C 'name':46B,95C 'network':2A,29B,33B,76C 'network-ai':1A,28B,32B,75C 'node':31B 'overwrit':12A,64B,118C 'pass':49B,105C 'path':4A,84C 'polici':65B,119C 'read':10A,59B,97C 'save':55B,111C 'sensit':60B,114C 'sequenc':51B,107C 'tool':27B 'travers':5A,50B,85C,106C 'trust':72B,125C 'trust-level':71B,124C 'version':35B 'vulner':86C 'write':99C","nicknames":[],"mitigations":[],"who_affected":"Teams running Network-AI from 5.13.4 up to but not including 5.15.5 that use AgentVCR with cassette names an attacker or untrusted agent can influence. Systems that only use fixed, server-chosen cassette names or that do not use AgentVCR are not exposed. unknown whether other components are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentvcr","aiagents","aitooling","high","networkai","node"],"first_public_at":"2026-11-02T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120312","severity":null,"published_at":"2026-11-02T03:17:28+00:00","modified_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","fetched_at":"2026-11-02T03:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}