network-ai vulnerabilities (npm)
9 vulnerabilities.
-
network-ainpm EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data 6.1 Medium -
network-ainpm Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups 5.5 Medium -
network-ainpm Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions 5.9 Medium -
network-ainpm Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory 6.5 Medium -
network-ainpm Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning 7.1 High -
network-ainpm Network-AI has an an OS Command Injection issue 9.9 Critical -
network-ainpm Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701) 9.1 Critical -
network-ainpm Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret 7.6 High -
network-ainpm Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls 8.7 High