Symlink Traversal Vulnerability in Network-AI Multi-Agent Orchestrator
CVE-2026-58414
5.5MEDIUM
What is CVE-2026-58414?
The Network-AI orchestrator, crafted in TypeScript/Node.js, has a vulnerability due to its handling of symbolic links during backup operations. Specifically, prior to version 5.12.2, the backup() function utilized statSync() to collect files, which could inadvertently traverse symlinks leading to exposure of files outside the intended environment root. This risk allows an attacker, capable of placing a symlink in the environment data directory, to access sensitive files through backup artifacts. To mitigate this, version 5.12.2 implements lstatSync(), ensuring that symbolic links are not followed, thus bolstering the security of backup processes.
Affected Version(s)
Network-AI < 5.12.2