Network-AI’s AgentRuntime was designed to ensure file system access is confined to a user-specified sandbox directory. The containment logic, however, relied on simple string prefix comparisons, which allowed paths such as "/tmp/network-ai-sandbox_evil/secret.txt" to satisfy the check for the base path "/tmp/network-ai-sandbox". This flaw means that any agent or user able to invoke AgentRuntime.readFile() or AgentRuntime.listDir() can read or enumerate files outside the intended sandbox, exposing sensitive data residing in adjacent directories. The weakness is a typical path-traversal issue, represented by CWE-22 and CWE-23.

The vulnerability affects the Jovancoding Network-AI orchestrator in all releases prior to version 5.12.2. The fix was introduced in v5.12.2, where SandboxPolicy.resolvePath() and isPathAllowed() now enforce separator-anchored prefix checks to validate that resolved paths are equal to or descend from the configured base.

With a CVSS score of 6.5, the issue is classified as medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a file path that shares the same base prefix but points to a sibling directory, and to have the ability to call AgentRuntime.readFile() or listDir(). No elevated system privileges are required, so the risk is confined to scenarios where the attacker can influence the API arguments or otherwise invoke these file-access methods.