Jovancoding/Network-AI

Security patch fixing 5 reported vulnerabilities in EnvironmentManager, SandboxPolicy, and ApprovalInbox.

Security fixes

GHSA-6x2m-p4xp-wg22 (Moderate) — EnvironmentManager.backup() symlink escape

• _collectBackupFiles() now uses lstatSync and skips entries where isSymbolicLink() is true. Symlinks are never followed, preventing backup from reading files outside the environment root.

GHSA-48x2-6pr9-2jjf (Moderate) — EnvironmentManager.restore() backup ID path traversal

• restore() validates backupId against /^[\w\-]+$/ and asserts dirname(backupPath) === resolve(backupsDir) before any filesystem access. IDs like ../../etc are rejected immediately.

GHSA-2fmp-9rvw-hc96 (High) — Poisoned backup manifest arbitrary recursive deletion

• pruneBackups() no longer uses entry.path from the manifest for rmSync. The deletion path is recomputed from entry.backupId after format validation, and a dirname check enforces exactly one level of depth under the backups directory. A poisoned "path": "/" in a manifest is now harmless.

GHSA-jvcm-f35g-w78p (Moderate) — AgentRuntime sandbox path-prefix bypass

• SandboxPolicy.resolvePath() and isPathAllowed() now use sep-anchored prefix checks (basePath + sep). The previous bare startsWith(basePath) check allowed /foo/barextra to match basePath /foo/bar.

GHSA-mxjx-28vx-xjjj (Moderate) — ApprovalInbox HTTP server unauthenticated

• New secret option on ApprovalInboxOptions. When set, POST /:id/approve and POST /:id/deny require Authorization: Bearer <secret>. Validation uses timingSafeEqual (constant-time) to prevent timing oracle attacks. startServer() continues to default to 127.0.0.1 (loopback only).

Changed

• Version bump 5.12.1 -> 5.12.2 across all manifests and documentation headers.

Install: npm install [email protected] -- Published to npm with provenance.

Upgrading from 5.12.1: No breaking changes. The ApprovalInbox secret option is opt-in; existing deployments without a secret continue to work (backward-compatible but unauthenticated -- set a secret for any network-exposed instance).