CVE-2026-58481

Executive Summary

Business Impact: This vulnerability affects Network-AI, a TypeScript/Node.js multi-agent orchestrator. Organizations deploying Network-AI as a service to manage AI agents are at risk. The flaw allows a low-privileged agent or user to break out of the configured sandbox directory and read arbitrary files from the host filesystem. This is particularly dangerous in multi-tenant environments where different agents or users are expected to be isolated. The likely attacker is a malicious insider or a compromised agent account seeking to exfiltrate sensitive data (e.g., API keys, configuration files, other agents' data).

Vulnerability Class and Attack Vector: This is a Path Traversal vulnerability (CWE-22). The attack vector is network-accessible but requires low-level privileges (an agent/user that can call AgentRuntime.readFile() or AgentRuntime.listDir()). The vulnerability is exploited by crafting a file path that shares a prefix with the configured sandbox basePath, bypassing the intended path containment checks.

Urgency Assessment: The CVSS score is 6.5 (Medium). The EPSS exploitation probability is 0.0% as of 2026-07-20, indicating no observed exploitation in the wild. However, the vulnerability is trivial to exploit once the path traversal logic is understood, and the fix is straightforward. The urgency is moderate; organizations should prioritize patching to prevent potential data breaches, especially in multi-tenant deployments.

Key Facts:

• Vendor: Network-AI
• Affected Versions: Prior to v5.12.2
• Patch Status: Fixed in v5.12.2
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Metric Decomposition:

• AV:N (Network): The vulnerability is exploitable remotely over the network via the AgentRuntime API.
• AC:L (Low): No special conditions are required; the attacker only needs to craft a specific path string.
• PR:L (Low): The attacker must have a valid agent account or be able to call the readFile or listDir functions. This is not an unauthenticated vulnerability.
• UI:N (None): No user interaction is required.
• S:U (Unchanged): The compromise does not affect other components beyond the sandbox boundary.
• C:H (High): The vulnerability allows reading arbitrary files on the host filesystem, leading to high confidentiality impact.
• I:N (None): No integrity impact.
• A:N (None): No availability impact.

Qualitative Severity Label: Medium (CVSS 6.5).

EPSS Interpretation: An EPSS score of 0.0% means that as of the publication date, there is no observed exploitation activity in the wild. This is common for newly published CVEs. However, the low complexity of the exploit means this score could rise quickly once proof-of-concept code is shared.

Historical Comparison: This vulnerability is similar to path traversal flaws in other Node.js sandboxing libraries, such as CVE-2023-26136 (in sandbox npm package) and CVE-2022-25893 (in vm2). All involve insufficient path normalization or prefix checks leading to sandbox escape.

Temporal and Environmental Scores: The temporal score is currently low due to no known exploit. The environmental score can be higher in multi-tenant deployments where the confidentiality of other agents' data is critical.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability stems from a flawed path containment check in the SandboxPolicy class. The original code used a simple string prefix test to determine if a requested path was within the sandbox basePath. For example, if the basePath was /tmp/network-ai-sandbox, the check would verify if the requested path started with that string. This fails when a sibling directory shares the same prefix, e.g., /tmp/network-ai-sandbox_evil/secret.txt also starts with /tmp/network-ai-sandbox.

Step-by-Step Exploitation:

1. Pre-condition: The attacker has a valid agent account or can call AgentRuntime.readFile() or AgentRuntime.listDir().
2. Crafting the Path: The attacker identifies the configured basePath (e.g., /tmp/network-ai-sandbox). They then craft a path to a sibling directory, e.g., /tmp/network-ai-sandbox_evil/secret.txt.
3. Bypassing the Check: The vulnerable isPathAllowed() function checks if the requested path starts with the basePath. Since /tmp/network-ai-sandbox_evil/secret.txt starts with /tmp/network-ai-sandbox, the check passes.
4. File Access: The AgentRuntime.readFile() function reads the file at the crafted path, returning its contents to the attacker.

Attack Surface: The attack surface is the AgentRuntime API, specifically the readFile() and listDir() methods. These are typically exposed over HTTP or WebSocket in a Network-AI deployment.

Why Standard Defenses May Fail:

• WAF Rules: Generic path traversal rules may not catch this because the path does not contain ../ sequences.
• Input Validation: If the application only checks for ../ patterns, this attack will succeed.
• Filesystem Permissions: The sandbox process may run with sufficient privileges to read the target files.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pseudocode):

// SandboxPolicy.js (vulnerable)
class SandboxPolicy {
    constructor(basePath) {
        this.basePath = basePath;
    }

    isPathAllowed(targetPath) {
        // Vulnerable: simple prefix check
        return targetPath.startsWith(this.basePath);
    }

    resolvePath(userPath) {
        // Assume userPath is absolute or resolved relative to basePath
        return path.resolve(this.basePath, userPath);
    }
}

Patched Code (Pseudocode):

// SandboxPolicy.js (patched v5.12.2)
class SandboxPolicy {
    constructor(basePath) {
        this.basePath = path.resolve(basePath);
    }

    isPathAllowed(targetPath) {
        const resolved = path.resolve(targetPath);
        // Patched: separator-anchored prefix check
        return resolved === this.basePath || resolved.startsWith(this.basePath + path.sep);
    }

    resolvePath(userPath) {
        const resolved = path.resolve(this.basePath, userPath);
        if (!this.isPathAllowed(resolved)) {
            throw new Error('Path not allowed');
        }
        return resolved;
    }
}

What the Patch Changes:

• The isPathAllowed() function now uses path.resolve() to normalize the target path.
• The check ensures the resolved path is either exactly the basePath or starts with basePath followed by a path separator (/ on Unix, \ on Windows). This prevents matching sibling directories like /tmp/network-ai-sandbox_evil.

Regression Considerations: The patch is safe and does not introduce regressions. It only tightens the path containment logic.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-20T16:30:15.220Z
• Estimated Discovery: The vulnerability was likely discovered internally by the Network-AI team or reported by a security researcher.
• Disclosure Process: The CVE was published by the CNA (likely Network-AI or a third-party CNA). No details on the disclosure timeline are available.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-20.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Insider Threats: Malicious agents or users with low-level access seeking to exfiltrate data.
• Script Kiddies: Once a PoC is published, automated scanners will target exposed Network-AI instances.
• Nation-State Actors: In targeted attacks against organizations using Network-AI for sensitive AI agent orchestration.

Attack Campaign Context: No known campaigns are associated with this CVE as of publication.

Geographic Targeting: No specific geographic patterns are known.

Industry Verticals Most at Risk:

• Technology: Companies using Network-AI for internal AI agent management.
• Finance: Where AI agents handle sensitive financial data.
• Healthcare: Where AI agents process patient data.

Connection to Similar Vulnerabilities: This is a classic path traversal flaw, similar to those found in other Node.js sandboxing libraries (e.g., vm2, sandbox).

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Docker container running Ubuntu 22.04.
2. Network-AI Installation:

   git clone https://github.com/network-ai/network-ai *(link returned 404 — verify manually)*.git
   cd network-ai
   git checkout v5.12.1  # Vulnerable version
   npm install
   npm run build
   

3. Configuration: Set the sandbox basePath to /tmp/network-ai-sandbox.
4. Start the Service: npm start

Exploitation Walkthrough:

1. Identify the API Endpoint: Assume the AgentRuntime.readFile() is exposed via an HTTP API at /api/agent/readFile.
2. Craft the Malicious Path:
   • Target file: /etc/passwd
   • Crafted path: /tmp/network-ai-sandbox_evil/../../etc/passwd (or simply /tmp/network-ai-sandbox_evil/secret.txt if the sibling directory exists).
3. Send the Request:

   curl -X POST http://target:3000/api/agent/readFile \
     -H "Content-Type: application/json" \
     -d '{"path": "/tmp/network-ai-sandbox_evil/../../etc/passwd"}'
   

4. Expected Output: The contents of /etc/passwd are returned.

Post-Exploitation: The attacker can read any file the Node.js process has access to, including:

• Configuration files (.env, config.json)
• SSH keys
• Other agents' data
• Database credentials

Blue Team Section

Detection:

• Log Entries: Look for AgentRuntime.readFile() calls with paths that do not match the expected sandbox pattern.
• Network Traffic: Unusual file read requests to paths outside the expected sandbox.
• Endpoint Indicators: The Node.js process accessing files outside its working directory.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• HTTP requests to /api/agent/readFile or /api/agent/listDir with paths containing sibling directory names (e.g., sandbox_evil, sandbox-backup).

HTTP Request Patterns:

POST /api/agent/readFile HTTP/1.1
Content-Type: application/json

{"path": "/tmp/network-ai-sandbox_evil/../../etc/passwd"}

File System Artifacts:

• Temporary files created in sibling directories (e.g., /tmp/network-ai-sandbox_evil/).

Process Execution Anomalies:

• The Node.js process reading files outside its expected sandbox directory.

Log Entries:

[2026-07-20T12:00:00Z] [WARN] AgentRuntime.readFile() called with path: /tmp/network-ai-sandbox_evil/../../etc/passwd

STIX-like IOC List:

Detection Engineering

YARA Rule

rule CVE_2026_58481_Network_AI_Path_Traversal {
    meta:
        description = "Detects exploitation of CVE-2026-58481 in Network-AI"
        author = "Valters IT Hub"
        date = "2026-07-20"
        reference = "https://www.valtersit.com/cve/cve-2026-58481"
        severity = "medium"
    strings:
        $s1 = "/api/agent/readFile" ascii wide nocase
        $s2 = "/api/agent/listDir" ascii wide nocase
        $s3 = "network-ai-sandbox" ascii wide nocase
        $s4 = "basePath" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3 and $s4
}

Sigma Rule (SIEM)

title: CVE-2026-58481 Network-AI Sandbox Escape Detection
id: 787e40fa-85bf-44ea-912e-888e97140779
status: experimental
description: Detects exploitation attempts targeting CVE-2026-58481 in Network-AI
author: Valters IT Hub
date: 2026-07-20
references:
    - https://www.valtersit.com/cve/cve-2026-58481
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        c-uri|contains:
            - '/api/agent/readFile'
            - '/api/agent/listDir'
        cs-uri-query|contains:
            - 'network-ai-sandbox'
    condition: selection
falsepositives:
    - Legitimate administrative activity using the sandbox path
level: high

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-58481 Network-AI Sandbox Escape Attempt";
    flow:to_server;
    content:"/api/agent/readFile"; http_uri;
    content:"network-ai-sandbox"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Elastic (EQL) Query

sequence by host.name
  [file where event.action == "read" and
   file.path : "*network-ai-sandbox*" and
   not file.path : "*network-ai-sandbox/*"]

Splunk SPL Query

index=web sourcetype=access_combined
  uri="/api/agent/readFile" OR uri="/api/agent/listDir"
  uri_query=*network-ai-sandbox*
  | table _time, src_ip, uri, uri_query

Wazuh Rule

<rule id="100001" level="10">
  <if_sid>31151</if_sid>
  <field name="url">/api/agent/readFile|/api/agent/listDir</field>
  <field name="url" type="pcre2">network-ai-sandbox</field>
  <description>CVE-2026-58481: Network-AI Sandbox Escape Attempt</description>
  <group>cve_2026_58481,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours):

1. Patch: Upgrade to Network-AI v5.12.2 immediately.

   npm update network-ai
   

2. Compensating Controls (if patching is delayed):
   • Restrict access to the AgentRuntime API to trusted IPs only.
   • Implement a reverse proxy (e.g., Nginx) with a WAF rule to block paths containing network-ai-sandbox followed by an underscore or other characters.
   • Monitor logs for suspicious readFile and listDir calls.

Short-term (1-7 days):

1. Configuration Hardening:
   • Ensure the sandbox basePath is a dedicated directory with no sibling directories sharing its prefix.
   • Use a unique, random string for the sandbox directory name (e.g., /tmp/network-ai-sandbox-a7f3b2).
2. Monitoring Implementation:
   • Deploy the detection rules provided above.
   • Set up alerts for any readFile or listDir calls with paths outside the expected sandbox.
3. Vulnerability Scanning:

   npm audit | grep CVE-2026-58481
   

Long-term:

1. Architecture Changes:
   • Implement a more robust sandboxing mechanism, such as using OS-level containers (Docker) or chroot for each agent.
   • Use a dedicated filesystem namespace for each agent.
2. Security Control Improvements:
   • Add input validation to ensure paths are normalized and do not contain unexpected characters.
   • Implement a deny-list for sensitive files (e.g., /etc/passwd, .env).
3. Developer Training:
   • Educate developers on secure path handling and the dangers of simple prefix checks.

Validation:

• Verify the installed version:

  npm list network-ai
  

• Confirm the patch by checking the SandboxPolicy.js file for the separator-anchored prefix check.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58481
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-58481
• Vendor advisory: See vendor security page at https://github.com/network-ai/network-ai (link returned 404 — verify manually)/security/advisories
• OSV: https://osv.dev/vulnerability/CVE-2026-58481
• Related CWE: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-20 | https://www.valtersit.com/cve/cve-2026-58481