CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWi...

CVE-2026-120312

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load or save to disclose sensitive JSON data or overwrite policy files suc...

EUVD-2026-115002

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWi...

CVE-2026-120313

Network-AI versions prior to 5.15.5 are vulnerable to a path traversal vulnerability in the InputSanitizer.sanitizePath() function. The root cause is an unanchored startsWith check , which allows attackers to bypass directory restrictions by supplying sibling-directory paths that share a string p...

CVE-2026-120313 Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWi...

EUVD-2026-115003

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

CVE-2026-120314

The Network-AI software (versions 5.14.0 before 5.15.5 ) is vulnerable to a missing authentication flaw in the A2AServer class. This vulnerability occurs when no secret is configured, allowing unauthenticated attackers to access task operations via JSON-RPC requests. Specifically, an attacker can...

EUVD-2026-115001

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load or save to disclose sensitive JSON data or overwrite policy files suc...

CVE-2026-120312

The Network-AI software (versions 5.13.4 before 5.15.5 ) is vulnerable to a path traversal vulnerability within the AgentVCR component. An attacker who can control the cassette name can inject traversal sequences into the load() or save() functions to read or write arbitrary .json files. This cou...

CVE-2026-120312 Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load or save to disclose sensitive JSON data or overwrite policy files suc...

EUVD-2026-115000

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get, FileJobStore.delete, or JobQueue.getJ...

CVE-2026-120311

The Network-AI software (versions 5.13.4 before 5.15.5 ) contains a path traversal vulnerability in the FileJobStore component. An attacker who can control the job id passed to functions such as FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can supply traversal sequences to read...

CVE-2026-109332

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109330

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

CVE-2026-109331

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP...

EUVD-2026-97634

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109332 Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109332 Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109332 Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109332

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...