CVE-2026-120312

Network-AI cassette names can read or overwrite external JSON

Jovancoding · Network-AI AgentVCR record/replay tooling

First documented disclosure · Review checkpoint

Summary

An untrusted cassette name can redirect reads and writes outside the configured recording directory.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled researcher evidence; the reviewed primary sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

AgentVCR joins the caller’s name plus a .json suffix without containment checks. Loading JSON and then saving it can copy attacker-chosen content to a different JSON path.

Conditions required

A caller can influence cassette names supplied to load or save; filesystem permissions and the appended .json extension limit reach.

Potential impact

Disclosure or overwrite of JSON data and security policy. The report describes altered AuthGuardian trust and grant state; it does not demonstrate remote code execution.

Affected versions and configurations

Network-AI 5.13.4 through 5.15.4.

Fix and mitigation status

5.15.5 uses safeChildPath for cassette names; this is an issue-specific fix.

Practical next steps

Upgrade, accept only validated cassette identifiers and restrict the agent process’s write access to configuration and authorization stores.

Operating lesson

Record/replay artifacts must not gain write authority over policy files.

Evidence and limits

Advisory and fixed release October 17; CNA November 2. The release explicitly names this GHSA, resolving the original body’s stale unfixed statement. CNA High 8.7 CVSS 4.0 differs from maintainer 8.8 CVSS 3.1; both are attributed rather than averaged.

Sources