GHSA-6x2m-p4xp-wg22

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. Confirmed in Network-AI 5.12.1. ### Details `backup()` collects file paths and copies them into the backup directory: ```ts const files = this._collectBackupFiles(envDir); for (const rel of files) { const src = join(envDir, rel); const dst = join(backupPath, rel); mkdirSync(join(backupPath, rel.includes('/') ? rel.substring(0, rel.lastIndexOf('/')) : '.'), { recursive: true }); try { copyFileSync(src, dst); } catch { /* skip unreadable */ } } ``` `_collectBackupFiles()` follows symlinked directories because it calls `statSync()`, not `lstatSync()`: ```ts const info = statSync(full); if (info.isDirectory()) { walk(full, rel); } else { results.push(rel); } ``` Default CLI reachability exists through `network-ai env backup create --env <env>`. `backup()` also runs automatically before promotion and restore operations. Affected source evidence: - `lib/env-manager.ts:435-460` — backup copy logic. - `lib/env-manager.ts:596-617` — symlink-following `_collectBackupFiles()`. - `bin/cli.ts:413-420` — default CLI exposes backup creation. - `lib/env-manager.ts:294-297` and `483-484` — backup also runs before promote/restore. ### PoC This PoC uses only temporary files. It creates a symlink inside `data/dev` pointing to an external directory, then runs `backup('dev')` and observes that the external file is copied into the backup: ```bash TMP=$(mktemp -d) TMPBASE="$TMP" node -r ts-node/register/transpile-only - <<'TS' const { EnvironmentManager