# CVE-2026-120312: Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Jovancoding / Network-AI (network-ai): ≥ 5.13.4; < 5.15.5 (affected, semver); 5.15.5 (unaffected, semver). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-23

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48 (CNA: VulnCheck; vendor-advisory)

- https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-agentvcr-cassette-name (CNA: VulnCheck; third-party-advisory)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-120312; retrieved 2026-11-02; source updated 2026-11-02

Revision: 4a93ce262313c04a65a116a167f40ae74de32f372fe5fc2c4d6bf3b05f4a1eba

Canonical: https://y2.dev/cve/CVE-2026-120312