pkg:npm/network-ai

All known vulnerabilities

• CRITICAL9.9CVE-2026-54051Network-AI: Improper Neutralization of Special Elements used in an OS Command
  from 0, < 5.9.1
• CRITICAL9.1CVE-2026-48814Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
  from 0, < 5.7.2
• HIGH7.6CVE-2026-46701Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
  from 0, < 5.4.5
• HIGH7.1Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
  from 0, < 5.12.2
• MEDIUM6.5Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
  from 0, < 5.12.2
• MEDIUM6.1Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
  from 0, < 5.12.2
• MEDIUM5.9Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
  >= 5.0.0, < 5.12.2
• MEDIUM5.5Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
  from 0, < 5.12.2
• —Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
  from 0, < 5.1.3