CVE-2026-58484: Network-AI Path Traversal Vulnerability

CVE-2026-58484 Overview

CVE-2026-58484 is a path traversal vulnerability [CWE-22] in Network-AI, a TypeScript/Node.js multi-agent orchestrator for Claude Code. The flaw exists in the EnvironmentManager module, where listBackups() reads each backup's _manifest.json and trusts the manifest's path field. The pruneBackups() function then passes that trusted entry.path directly to rmSync(entry.path, { recursive: true, force: true }). An attacker able to write a manifest to data/<env>/.backups/<name>/_manifest.json can trigger recursive deletion of arbitrary paths accessible to the Network-AI process user. The issue is fixed in version 5.12.2.

Critical Impact
A poisoned manifest containing "path": "/" can cause network-ai env backup prune to recursively delete arbitrary filesystem paths writable by the process user, resulting in data destruction and denial of service.

Affected Products

Network-AI (Jovancoding/Network-AI) versions prior to 5.12.2
Network-AI Claude Code plugin versions prior to 5.12.2
Environments invoking EnvironmentManager.pruneBackups() via CLI or programmatic paths

Discovery Timeline

2026-07-20 - CVE-2026-58484 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-58484

Vulnerability Analysis

The vulnerability resides in Network-AI's backup pruning logic. EnvironmentManager.listBackups() enumerates backup directories under data/<env>/.backups/ and parses each _manifest.json. The parsed manifest object includes a path field that the code treats as authoritative. When pruneBackups() decides which backups to remove, it forwards the manifest-supplied entry.path to Node.js rmSync() with recursive: true and force: true.

Because the deletion target originates from untrusted on-disk data, an attacker who can write or modify a single manifest file controls the argument to a recursive filesystem removal. There is no format validation, no allow-list check, and no confinement to the backups directory before the deletion occurs.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. pruneBackups() trusts attacker-influenceable manifest data instead of deriving the deletion path from a validated identifier. Any file whose contents an attacker can control effectively becomes a delete-anywhere primitive under the privileges of the Network-AI process.

Attack Vector

Exploitation requires local access with write permission to the data/<env>/.backups/<name>/ directory. The attacker creates or modifies _manifest.json to set path to an arbitrary target such as / or a sensitive application directory. When an operator or scheduled task runs network-ai env backup prune --env <env> --keep <n>, or any code path that invokes pruneBackups(), the recursive delete executes against the poisoned path.

The patch commit a59c13a bumps the plugin version from 5.12.1 to 5.12.2 and rewires pruneBackups() to recompute the deletion path from a format-validated entry.backupId, adding a dirname containment check that limits deletion to exactly one level under the backups directory.

text

// Patch metadata from .claude-plugin/plugin.json
{
  "name": "network-ai",
-  "version": "5.12.1",
+  "version": "5.12.2",
}
// Source: https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3

Detection Methods for CVE-2026-58484

Indicators of Compromise

_manifest.json files under data/<env>/.backups/<name>/ containing a path value that resolves outside the backups directory (e.g. "path": "/", "path": "/etc", or absolute paths targeting application data).
Unexpected recursive deletions occurring immediately after network-ai env backup prune executions in shell history or CI logs.
Backup directories with modification timestamps or ownership inconsistent with the Network-AI service account.

Detection Strategies

Audit all _manifest.json files across environments and flag any where the path field is absolute or does not resolve to a direct child of the corresponding .backups directory.
Monitor process execution for network-ai env backup prune invocations and correlate them with subsequent unlinkat or rmdir syscalls on paths outside the expected backup tree.
Track Network-AI version strings in .claude-plugin/plugin.json and .claude-plugin/marketplace.json to identify hosts still running versions prior to 5.12.2.

Monitoring Recommendations

Enable filesystem auditing (auditd, eBPF, or equivalent) on directories containing Network-AI data and alert on recursive deletions triggered by the Network-AI process user.
Log every CLI invocation of network-ai env backup prune with full arguments and the resolved deletion targets for post-hoc review.
Alert on write operations to _manifest.json files performed by any principal other than the Network-AI service account.

How to Mitigate CVE-2026-58484

Immediate Actions Required

Upgrade Network-AI to version 5.12.2 or later on every host and container image where the orchestrator or Claude Code plugin is installed.
Inventory existing _manifest.json files and remove or sanitize any manifest whose path field points outside its own backup directory.
Restrict write access to data/<env>/.backups/ to the Network-AI service account and remove group or world write bits.

Patch Information

The fix is delivered in GitHub Release v5.12.2 via commit a59c13a1. pruneBackups() no longer trusts entry.path from the on-disk manifest. The deletion path is recomputed from a format-validated entry.backupId, and a dirname containment check confines deletion to exactly one level under the backups directory. See GHSA-2fmp-9rvw-hc96 for the vendor advisory.

Workarounds

Do not invoke network-ai env backup prune on affected versions until the upgrade to 5.12.2 is complete.
Run the Network-AI process under a dedicated low-privilege user with no write access to system directories or unrelated application data.
Place data/<env>/.backups/ on a filesystem mount with restrictive ACLs and consider read-only bind mounts for other sensitive paths.

bash

# Upgrade Network-AI to the patched release
npm install -g network-ai@5.12.2

# Verify the installed version
network-ai --version

# Audit manifests for out-of-tree path values
find data -type f -name _manifest.json -exec \
  grep -HnE '"path"[[:space:]]*:[[:space:]]*"(/|[^"]*\.\.)' {} \;