GHSA-2fmp-9rvw-hc96

### Summary `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data/<env>/.backups/<name>/_manifest.json` can cause `network-ai env backup prune --env <env> --keep <n>` or any code path invoking `pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. Confirmed in Network-AI 5.12.1. ### Details `listBackups()` trusts manifest content from disk: ```ts for (const name of readdirSync(backupsDir)) { const manifest = join(backupsDir, name, '_manifest.json'); if (existsSync(manifest)) { try { const entry = JSON.parse(readFileSync(manifest, 'utf-8')) as BackupEntry; entries.push(entry); } catch { /* corrupt manifest, skip */ } } } ``` `pruneBackups()` uses the attacker-controlled `entry.path` as the deletion target: ```ts const toDelete = all.slice(keep); let deleted = 0; for (const entry of toDelete) { try { rmSync(entry.path, { recursive: true, force: true }); deleted++; } catch { /* ignore */ } } ``` Default CLI reachability exists through `network-ai env backup prune --env <env> --keep <n>`. Affected source evidence: - `lib/env-manager.ts:505-523` — reads trusted backup entries from `_manifest.json`. - `lib/env-manager.ts:529-541` — recursively deletes `entry.path`. - `bin/cli.ts:464-472` — default CLI exposes backup pruning. ### PoC This PoC uses only a temporary directory and deletes only a temporary file: ```bash TMP=$(mktemp -d) TMPBASE="$TMP" node -r ts-node/register/transpile-only - <<'TS' const { EnvironmentManager } = require('./lib/env-manager'); const fs = require('fs'); const path = require('path'); const base = process.env.TMPBASE; const mgr = new EnvironmentManager(path.join(base, 'data'), { chain: ['dev', 'st