Vendor
Jovancoding
20 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Medium 4.3
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim runnin…
-
Medium 5.9
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require exp…
-
Medium 6.5
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/n…
-
Medium 5.5
Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>…
-
Medium 6.1
EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the…