CVE-2026-58484
- EPSS 0.21%
- Veröffentlicht 20.07.2026 17:00:56
- Zuletzt bearbeitet 13.08.2026 16:24:58
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes tha...
CVE-2026-58482
- EPSS 0.16%
- Veröffentlicht 20.07.2026 16:38:55
- Zuletzt bearbeitet 13.08.2026 16:24:46
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to re...
CVE-2026-46701
- EPSS 0.22%
- Veröffentlicht 20.07.2026 16:33:43
- Zuletzt bearbeitet 13.08.2026 15:33:56
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-trans...
CVE-2026-58481
- EPSS 0.2%
- Veröffentlicht 20.07.2026 16:30:15
- Zuletzt bearbeitet 13.08.2026 16:24:27
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such a...
CVE-2026-58414
- EPSS 0.2%
- Veröffentlicht 20.07.2026 16:28:29
- Zuletzt bearbeitet 13.08.2026 16:09:43
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `d...
CVE-2026-58413
- EPSS 0.2%
- Veröffentlicht 20.07.2026 16:26:07
- Zuletzt bearbeitet 13.08.2026 16:02:19
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not re...