CVE-2026-120312 Jovancoding CVE debrief

Who should care

Defenders and security teams using Network-AI versions from 5.13.4 before 5.15.5 should assess potential exposure and impact. They should prioritize verifying exposure, assessing potential impact, and updating affected systems to prevent potential data disclosure and policy file overwrites.

Why it matters

CVE-2026-120312 is a high-severity path traversal vulnerability in Network-AI's AgentVCR. Defenders should prioritize verifying exposure, assessing potential impact, and updating affected systems to prevent potential data disclosure and policy file overwrites.

• Potential data disclosure through arbitrary .json file reading
• Possible policy file overwrites, such as AuthGuardian trust-level configuration
• Verification of Network-AI version and exposure is necessary
• Remediation priority is high due to potential impact on sensitive data and system configuration

Technical summary

The path traversal vulnerability in Network-AI's AgentVCR allows attackers to control the cassette name and read or write arbitrary .json files. This issue affects Network-AI versions from 5.13.4 before 5.15.5. The vulnerability can lead to potential data disclosure and policy file overwrites, such as AuthGuardian trust-level configuration. Defenders should prioritize verifying exposure and assessing potential impact, especially in environments using affected Network-AI versions. The vulnerability can be exploited by passing traversal sequences to load() or save() functions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, especially in environments using affected Network-AI versions.

Recommended defensive actions

• Verify Network-AI version and assess exposure
• Review and update affected systems
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in Network-AI's AgentVCR. However, additional information on potential exploitation and affected systems is limited. Defenders should verify Network-AI version and assess exposure, review and update affected systems, and monitor for potential exploitation attempts. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.