{"id":15186,"date":"2026-09-04T19:02:29","date_gmt":"2026-09-04T11:02:29","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-58484"},"modified":"2026-09-04T19:02:29","modified_gmt":"2026-09-04T11:02:29","slug":"cve-2026-58484","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-58484","title":{"rendered":"CVE-2026-58484 [HIGH] &#8211; Network-AI is a TypeScript\/Node.js multi-agent orchestrator. Prior to version 5.12.2, `Env"},"content":{"rendered":"<p>Network-AI is a TypeScript\/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup&#8217;s `_manifest.json` and trusts the manifest&#8217;s `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data\/\/.backups\/\/_manifest.json` can cause `network-ai env backup prune &#8211;env  &#8211;keep ` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `&#8221;path&#8221;: &#8220;\/&#8221;`) is now inert.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Network-AI is a TypeScript\/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup&#8217;s `_manifest.json` and trusts the manifest&#8217;s `path` field. `E<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15186","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}