CVE-2026-58414

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, "EnvironmentManager.backup" recursively collects files using "collectBackupFiles". "collectBackupFiles" uses "statSyncfull", which follows symlinks. If "data/" contains a symlink to a directory outside the...

CVE-2026-58414: Improper Limitation of a Pathname to a Restricted Directory

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup recursively collects files using collectBackupFiles. collectBackupFiles uses statSyncfull, which follows symlinks. If data/ contains a symlink to a directory outside the environment roo...