Skip to content
OpenAdvisories

Package · npm

network-ai

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-58484

    Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

    Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted…

    Jovancoding Network-AI network-ai npm
  • High 7.6
    CVE-2026-46701

    Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

    Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.…

    Jovancoding Network-AI network-ai npm
  • High 8.7
    CVE-2026-42856

    Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls

    Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry.…

    Jovancoding Network-AI network-ai npm