CVE-2026-58484

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, "EnvironmentManager.listBackups" reads each backup's "manifest.json" and trusts the manifest's "path" field. "EnvironmentManager.pruneBackups" later passes that trusted "entry.path" directly to "rmSyncentry.path...

CVE-2026-58484: Improper Limitation of a Pathname to a Restricted Directory

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive...