network-ai vulnerabilities
CVEs whose affected-version data names the network-ai package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-48814Critical· 9.1Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
CVE-2026-54051Critical· 9.9Network-AI: Improper Neutralization of Special Elements used in an OS Command
Network-AI: Improper Neutralization of Special Elements used in an OS Command
GHSA-2fmp-9rvw-hc96High· 7.1Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
GHSA-jvcm-f35g-w78pMedium· 6.5Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
GHSA-mxjx-28vx-xjjjMedium· 5.9Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
GHSA-6x2m-p4xp-wg22Medium· 5.5Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
GHSA-48x2-6pr9-2jjfMedium· 6.1Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data