TypeScript/Node.js Multi-Agent Orchestrator Vulnerability in Network-AI

CVE-2026-58481

What is CVE-2026-58481?

A vulnerability has been identified in Network-AI, a multi-agent orchestrator built on TypeScript and Node.js. Prior to version 5.12.2, the AgentRuntime component allows scoped file access under a sandbox configuration. However, the path containment checks rely on raw string prefix comparisons, which can be easily bypassed. This flaw permits an agent or user to invoke AgentRuntime.readFile() or AgentRuntime.listDir() to access files that lie outside the predefined sandbox area, provided those files are located in sibling directories sharing the same base path. The issue has been mitigated in version 5.12.2, where improvements were made to ensure that the sandbox enforcement logic utilizes separator-anchored prefix checks, thus preventing unauthorized access via similarly named paths.

References