CVE-2026-58481 Overview
CVE-2026-58481 is a path traversal vulnerability [CWE-22] in Network-AI, a TypeScript/Node.js multi-agent orchestrator. Versions prior to 5.12.2 implement sandbox path containment using raw string prefix comparisons. A sandbox basePath such as /tmp/network-ai-sandbox also matches sibling directories like /tmp/network-ai-sandbox_evil. An agent or user calling AgentRuntime.readFile() or AgentRuntime.listDir() can therefore read or enumerate files outside the intended sandbox. This breaks the documented sandbox boundary and violates least-privilege guarantees for orchestrated agent workloads.
Critical Impact
Authenticated local actors with agent invocation rights can read files in sibling directories that share a name prefix with the sandbox base, exposing sensitive data outside the sandbox scope.
Affected Products
- Network-AI multi-agent orchestrator versions prior to 5.12.2
- Deployments relying on AgentRuntime sandbox basePath isolation
- Applications exposing AgentRuntime.readFile() or AgentRuntime.listDir() to agents or end users
Discovery Timeline
- 2026-07-20 - CVE-2026-58481 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-58481
Vulnerability Analysis
The flaw resides in Network-AI's SandboxPolicy path containment logic. The runtime is designed to constrain agent file operations to a configured basePath. However, the pre-5.12.2 implementation validates candidate paths by calling a raw string prefix check against basePath. String prefix equality is not equivalent to directory containment on POSIX or Windows file systems.
Because the check does not require a path separator boundary after basePath, any sibling directory whose name begins with the same characters passes validation. For example, with a sandbox base of /srv/app, a resolved target of /srv/app-evil/secret.txt is treated as in-scope. The runtime then services readFile() and listDir() requests against that sibling location.
The impact is limited to confidentiality of files readable by the Network-AI process, and requires local access with agent invocation privileges. Integrity and availability are not directly affected.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. SandboxPolicy.resolvePath() and isPathAllowed() compared resolved paths using unanchored string prefix logic. The absence of a trailing separator check allowed sibling directories sharing a name prefix to satisfy the allow-list.
Attack Vector
An attacker who can invoke AgentRuntime.readFile() or AgentRuntime.listDir() supplies a path resolving to a sibling directory whose name shares the sandbox base prefix. The runtime accepts the path, opens the file or enumerates the directory, and returns its contents to the caller. Exploitation requires local access and low-privileged agent invocation rights; no user interaction is needed. See the GitHub Security Advisory GHSA-jvcm-f35g-w78p for advisory details.
No verified proof-of-concept code is published. The vulnerability mechanism is described in prose based on the vendor advisory.
Detection Methods for CVE-2026-58481
Indicators of Compromise
- Agent runtime logs recording readFile or listDir calls with resolved paths outside the intended sandbox base directory
- File access events targeting directories whose names begin with the sandbox basePath string but are not equal to it or nested under it
- Unexpected reads of sensitive files residing adjacent to the sandbox root, such as configuration or credential files
Detection Strategies
- Instrument AgentRuntime calls to log both the requested path and the fully resolved absolute path for every file operation
- Correlate resolved paths against the configured sandbox basePath using separator-anchored comparison in a detection rule
- Alert when agent-initiated file operations touch paths that share only a prefix with the sandbox root
Monitoring Recommendations
- Forward Network-AI application logs to a centralized SIEM or data lake for path-based anomaly analysis
- Monitor host-level file access telemetry for the Network-AI service account reading files outside the sandbox directory tree
- Track upgrades to version 5.12.2 or later across all Network-AI deployments in the environment
How to Mitigate CVE-2026-58481
Immediate Actions Required
- Upgrade Network-AI to version 5.12.2 or later, which introduces separator-anchored prefix checks in SandboxPolicy
- Audit existing sandbox basePath configurations for sibling directories sharing name prefixes and rename or relocate them
- Restrict which agents and users can invoke AgentRuntime.readFile() and AgentRuntime.listDir() to the minimum required set
Patch Information
The fix is released in Network-AI v5.12.2. SandboxPolicy.resolvePath() and isPathAllowed() now enforce containment with resolved === base || resolved.startsWith(base + path.sep) for both allow-list and block-list evaluations. Sibling directories sharing only a name prefix are no longer treated as in-scope. See the remediation commit for implementation details.
Workarounds
- Configure the sandbox basePath inside a dedicated parent directory that contains no siblings sharing its name prefix
- Run the Network-AI process under a dedicated OS user whose file system permissions restrict access to only the sandbox directory tree
- Apply OS-level mandatory access controls such as AppArmor or SELinux profiles to constrain file reads to the sandbox root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
