GHSA-jvcm-f35g-w78p

### Summary `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. Confirmed in Network-AI 5.12.1. Severity: Medium, CVSS 3.1 vector `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`. ### Details The vulnerable containment check is in `lib/agent-runtime.ts`: ```ts resolvePath(filePath: string): string | null { const normalized = normalize(filePath); const absolute = isAbsolute(normalized) ? normalized : join(this.config.basePath, normalized); const resolved = resolve(absolute); // Traversal check if (!resolved.startsWith(this.config.basePath)) return null; return resolved; } ``` `startsWith()` is not path-boundary-aware. If `this.config.basePath` is `/tmp/network-ai-sandbox`, then `/tmp/network-ai-sandbox_evil/secret.txt` also starts with `/tmp/network-ai-sandbox` despite being outside the sandbox. The same pattern appears in `SandboxPolicy.isPathAllowed()` for allowed and blocked paths. `FileAccessor.read()`, `FileAccessor.write()`, and `FileAccessor.list()` rely on these checks before I/O, and `AgentRuntime.readFile()` exposes this behavior. Reads auto-approve by default when `autoApproveReads` is enabled. Affected source evidence: - `lib/agent-runtime.ts:393-423` — `isPathAllowed()` / `resolvePath()` use string `startsWith()` containment. - `lib/agent-runtime.ts:669-691` — file read sink relies on those checks. - `lib/agent-runtime.ts:933-958` — `AgentRuntime.readFile()` exposes file reads. ### PoC Run from the repository root after installing dependencies: ```bash node -r