Description
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Jovancoding Network-AI
Default version status: unaffected
5.0.0 to < 5.15.2affected5.15.2unaffected
pkg:npm/network-ai