Live › vulnerability › CVE-2026-120313
Network-AI before 5.15.5 has a flawed path check in InputSanitizer.sanitizePath() that uses an unanchored startsWith test. An attacker can supply a sibling directory whose name shares the base directory's prefix to read, list, or write files outside the intended sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Teams that run Network-AI below 5.15.5 and pass user-influenced file paths through InputSanitizer.sanitizePath(), particularly in agent or tool setups that read or write files. Projects that pin a fixed version or never expose file path inputs to untrusted users are less exposed. Sources do not say which exact deployment patterns are most at risk.
No product ranges from the sources yet.
npm ls network-ai, and see whether it is below 5.15.5.sanitizePath or InputSanitizer to see whether user-supplied paths reach them.5.15.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.
This page as .md · .json · in your agent: get_signal("CVE-2026-120313")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.