TI-2026-42088 CVE-2026-58484
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
Priority HIGH 66
Network-AI is a TypeScript/Node.js multi-agent orchestrator.
Jovancoding
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
Jovancoding records in CISA KEVNo Jovancoding vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Network-ai · all components
TI-2026-42085 CVE-2026-58481
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Priority MEDIUM 62
Network-AI is a TypeScript/Node.js multi-agent orchestrator.
TI-2026-42086 CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Priority MEDIUM 60
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`).
TI-2026-42024 CVE-2026-58413
EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Priority MEDIUM 60
Network-AI is a TypeScript/Node.js multi-agent orchestrator.
TI-2026-42025 CVE-2026-58414
Path traversal in Jovancoding Network-AI
Priority MEDIUM 58
Network-AI is a TypeScript/Node.js multi-agent orchestrator.
TI-2026-34330 CVE-2026-46701 · GHSA-j3vx-cx2r-pvg8
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Priority LOW 33
Network-AI is a TypeScript/Node.js multi-agent orchestrator.