CVE-2026-58484 in Network-AI
Summary
by MITRE • 07/20/2026
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `"path": "/"`) is now inert.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within Network-AI's backup management system where the EnvironmentManager class processes backup manifests without proper validation of critical path information. The flaw stems from a lack of input sanitization and path containment checks when handling backup metadata files, creating a directory traversal condition that allows arbitrary file deletion. The issue is particularly dangerous because it operates at the filesystem level with elevated privileges, potentially enabling complete system compromise if the Network-AI process runs with administrative permissions.
The technical implementation of this vulnerability manifests through improper trust of manifest data within the `_manifest.json` files stored in backup directories. When `listBackups()` reads these manifests, it extracts the path field without validating its contents against a whitelist or performing path sanitization. This trusted path information is then passed directly to Node.js's `rmSync()` function with recursive and force flags enabled, creating an unrestricted deletion capability. The vulnerability aligns with CWE-22 Directory Traversal and CWE-78 Command Injection patterns, as the attacker can manipulate the execution path through malicious manifest content.
The operational impact of this vulnerability extends beyond simple file deletion to potentially enable complete system compromise when combined with other attack vectors or when the application executes with elevated privileges. An attacker could leverage this weakness to delete critical system files, backup data, or even entire directory structures within the application's working scope. This represents a privilege escalation scenario where an attacker with write access to the manifest files can execute arbitrary deletion commands through legitimate backup management interfaces.
The fix implemented in version 5.12.2 addresses the core issue by eliminating direct path trust and implementing proper containment measures. Instead of using the potentially malicious path from the manifest, the system now recomputes deletion paths based on validated backup identifiers and performs strict directory containment checks. This approach follows ATT&CK technique T1070.004 Indicator Removal on Host, specifically addressing the removal of backup files through unauthorized means. The solution incorporates input validation at multiple levels, ensuring that all deletion operations occur within a controlled scope strictly under the backups directory structure.
The mitigation strategy demonstrates proper secure coding practices by implementing defense-in-depth measures including path validation, containment checks, and input sanitization. The change prevents attackers from manipulating the backup pruning process through malicious manifest files while maintaining legitimate backup functionality. This fix aligns with security best practices for preventing arbitrary file operations in Node.js applications and follows industry standards for handling untrusted data in filesystem operations.
This vulnerability class highlights the importance of validating all external inputs, particularly when those inputs directly influence filesystem operations or system-level commands. The attack vector demonstrates how seemingly benign configuration files can become weaponized through improper trust assumptions, emphasizing the need for comprehensive input validation and privilege separation in application design. The remediation approach serves as a model for addressing similar vulnerabilities in other systems where backup management or file operations are involved, particularly in multi-agent or orchestrator architectures where multiple components interact with shared filesystem resources.